Open-source sandbox for coding agents

Give your agent a repo, not your machine.

Ukai wraps Claude Code, Codex, OpenCode or any command-line tool on Linux. You choose which files it can touch, which hosts it can reach and how long it can run. Every run ends with a receipt: what was allowed, what happened, and what Ukai couldn’t see.

Install

curl --proto '=https' --tlsv1.2 -fsSL https://ukai.sh/install.sh | bash

Linux x86_64 and ARM64 · Mac: offline VM preview · MIT · Developer preview

Read the quickstart See a real run

What stays protected

Your machine stays yours.

Coding agents run with your user account. Ukai gives them a workspace and nothing else you didn’t choose.

Your home directory

SSH keys, cloud credentials and your other projects do not exist inside the sandbox unless you grant them. The agent sees the system’s programs, its workspace and a scratch directory.

Your network

No network by default. Agent profiles reach only the hosts you name, such as your model provider and package registry, through Ukai’s proxy.

Your time

A hard deadline for the whole process tree. When the run ends, Ukai confirms every process is gone before it writes the final receipt.

A real run

One command. One receipt.

We ran this on our Linux reference host. The command tries to read an SSH file, reach the internet and write a file in its workspace. Only the write goes through.

Terminal

$ ukai-jail run --profile tool --workspace . --limit wall=30s -- \
    sh -c "cat $HOME/.ssh/authorized_keys; curl -sS https://example.com; echo ok > result.txt"
cat: /home/ubuntu/.ssh/authorized_keys: No such file or directory
curl: (6) Could not resolve host: example.com
$ cat result.txt
ok

jail.json · excerpt

{
  "schema": "ukai.jail.receipt/1",
  "phase": "settled",
  "containment": "enforced",
  "outcome": { "kind": "exited", "code": 0, … },
  "applied": {
    "network": { "mode": "none", "mechanism": "network-namespace", … },
    "limits": [
      { "key": "wall", "requested": "30000", "applied": true, "hit": false, … },
      …
    ],
    …
  },
  "lifetime": { "tree_empty": true, "integrity": "verified", … },
  "coverage": {
    "exec": { "status": "active", "observed_count": 7, "gaps": [], … },
    "fs.write": { "status": "active", "observed_count": 1, "gaps": [], … },
    "net": { "status": "active", "observed_count": 2, "gaps": [], … },
    …
  },
  "errors": []
}

The receipt answers three questions.

What was allowed?

applied · The boundary actually in force. Here: no network and a 30-second deadline.

How did it end?

outcome · The exit status, and in lifetime, confirmation that no process outlived the run.

What couldn’t Ukai see?

coverage · What was observed, class by class, and every gap. A gap is reported, never hidden.

Fields trimmed for length (…). Each run also keeps an event journal; read it with ukai-jail tail. The run record holds this run’s full output, receipt, policy and journal, with the build and host it ran on.

Full record of this run

Works with

The agent you already use.

Launch profiles for 14 agents, including Claude Code, Codex, OpenCode and Gemini CLI, plus any command-line tool. All profiles are experimental; OpenCode has recorded live runs.

Compatibility records

Why not Docker, or your agent’s own sandbox?

One tool for every agent. The same flags work for Claude Code, Codex, OpenCode or npm test.
Enforced outside the agent. You set the limits at launch and the Linux kernel enforces them, so the agent can’t loosen its own rules.
Nothing to build. No container image, no daemon and no sudo to run. One binary wraps the command you already use.
A record you can check. Every run leaves a receipt, on your laptop, your servers or in CI.

How it works

Set limits. Run. Review.

Set limits.

Start from a profile, then grant the paths, hosts and time the task needs.

Run your command.

Run your agent or CLI tool as usual. Ukai applies the limits to it and its child processes.

Review the run.

Read the receipt for the policy applied, the result and any gaps in observation. Then review the file changes.

Developer preview

Install Ukai

Install the developer preview, then follow the quickstart for your platform.

Terminal

curl --proto '=https' --tlsv1.2 -fsSL https://ukai.sh/install.sh | bash

The installer detects your platform and verifies SHA-256 hashes. No compiler or sudo required.

Linux

Run agents and CLI tools.

Signed x86_64 and ARM64 packages. Requires glibc 2.39+ and bubblewrap.

Linux quickstart

macOS VM preview

Run offline Linux commands.

Runs in a disposable VM. Requires Apple Silicon, macOS 27+, and 8 GiB free APFS storage.

Mac quickstart & limits

Ukai was called Ouroboros until October 2026. The current preview still installs the ouro-jail and ouro-vm commands; the next release installs ukai-jail.

Limits

What Ukai doesn’t do

An agent can still change the files you make writable and send readable data to the hosts you allow. Keep grants small and review the changes.
Observation covers a defined set of operations, not every read. The receipt says which ones it covered.
Containment relies on the host kernel. Ukai is a developer preview, and its security review is still pending.
The Mac preview runs offline Linux commands in a VM. It does not run native Mac programs or online agents.

Security limits in the guide

Read the guide and the evidence

Follow the setup guide, check benchmark results and their limitations, or see what we’re building next.

Read the guide Benchmarks & limitations View the roadmap