k8e.sh — Open Source Agentic AI Sandbox Matrix. A single binary under 100MB that turns any Linux host into a secure, isolated execution platform for AI agents — gVisor, Kata, or Firecracker isolation, warm-pool fast starts, and an E2B-compatible API. Up and running in 60 seconds.
curl -sfL https://k8e.sh/install.sh | sh -That's it. Your agentic sandbox matrix is ready. 🤖
K8E is the Open Source Agentic AI Sandbox Matrix — a self-hosted sandbox platform for running secure, isolated AI agent workloads at scale, packaged as a single binary under 100MB.
As autonomous AI agents increasingly generate and execute untrusted code, robust sandboxing infrastructure is no longer optional. K8E ships everything needed to spin up a production-grade cluster in under 60 seconds, with first-class primitives for agent isolation, resource governance, and persistent execution environments — purpose-built for the AI era.
🔒 One cluster. Many agents. Zero trust between them.
| Capability | Description |
|---|---|
| 🔒 Hardware Isolation | Pluggable runtimes: gVisor (default), Kata Containers, Firecracker microVM |
| 🌐 Network Policies | Bundled Cilium enforces the standard networking.k8s.io/v1 NetworkPolicy API by default — plus eBPF toFQDNs egress control per session; allowed_hosts enforced via --cilium-dns-proxy (KIP-16 M10) |
| ⚖️ Resource Quotas | CPU/memory caps per agent session to prevent runaway costs |
| 💾 Persistent Workspaces | Every session carries a PVC workspace (1Gi local-path by default); warm pods boot with their claim pre-provisioned — fast start and durable files |
| 🧠 Warm Pool | Pre-booted sandbox pods for sub-500ms session claim latency; application-layer readiness handshake, adaptive sizing, per-session background-run caps |
| 📸 Content-Addressed Snapshots | SHA-256 CAS layerstore with zstd compression, chunked multi-layer manifests, incremental --base restore, server-side registry, autosquash (KIP-16 M2) |
| 📜 Exec Transcripts | File-backed, windowed, offset-resumable command transcripts — k8e-sandbox-cli log (KIP-16 M4) |
| 📊 Observability | Prometheus metrics, disk-only NDJSON event stream, process topology — events / ps CLI (KIP-16 M5) |
| 🔄 Sub-agent Reuse | Sub-agents share the parent pod + workspace; isolated reset (KIP-16 M1) |
| 🧾 CLI Catalog | Machine-readable command/flag surface for SDK generation — catalog (KIP-16 M9) |
| 🤝 agent-sandbox compatible | Works with kubernetes-sigs/agent-sandbox |
| 🔄 SKILL + CLI + MCP | AI agents (Claude Code, Codex, Pi) connect via k8e-sandbox-cli or the /k8e-sandbox skill |
📚 Full documentation: k8e.sh/guide — guides, CLI reference, and examples live on the official site.
AI Agents (Claude Code / Codex / Pi / dsh)
│ k8e-sandbox-cli / plugin tools (gRPC over mTLS)
▼
┌──────────────────────────────────────────────┐
│ SANDBOX GATEWAY │
│ sessions · exec · files · PTY terminals │
│ expose · allow-hosts · snapshots │
│ warm pool · metrics · event stream │
└──────────────┬───────────────────────────────┘
│ claims ready pods from the warm pool
┌───────────▼───────────┐ ┌────────────────┐
│ SANDBOX POD │ │ SANDBOX POD │
│ gVisor / Kata / FC │ … │ (isolated) │
│ agent's code + PVC │ │ │
└───────────────────────┘ └────────────────┘
eBPF per-session network policy between all of them
One gateway fronts every operation — session lifecycle, streaming exec,
filesystem, PTY terminals, service exposure (expose), live egress policy
(allow-hosts) and content-addressed snapshots — so agents get one audited
door instead of raw infrastructure access.
gVisor is recommended — no KVM required:
ARCH=$(uname -m) # x86_64 on most servers, aarch64 on ARM
URL=https://storage.googleapis.com/gvisor/releases/release/latest/${ARCH}
wget ${URL}/gvisor.tar.zstd ${URL}/gvisor.tar.zstd.sha512
sha512sum -c gvisor.tar.zstd.sha512 # must print OK
sudo tar --zstd -xf gvisor.tar.zstd -C /usr/local/binK8E detects
runscat startup and automatically injects the gVisor stanza into its containerd config. Do not runrunsc install— K8E manages its own containerd configuration.
Need stronger isolation? Kata Containers and Firecracker are covered in the Sandbox Runtime Setup guide.
curl -sfL https://k8e.sh/install.sh | sh -k8e-sandbox-cli status # -> {"available": true, ...}
k8e-sandbox-cli run 'echo hello from the sandbox'Download the standalone sandbox CLI, authenticate, and install the /k8e-sandbox skill into your agent:
# 1. Download (~44MB) — pick your platform suffix
# k8e-sandbox-cli-linux-amd64 / linux-arm64 / darwin-arm64 / windows-amd64.exe
curl -sLO https://github.com/xiaods/k8e/releases/latest/download/k8e-sandbox-cli-linux-amd64
chmod +x k8e-sandbox-cli-linux-amd64
# 2. Create an API key on the server (default TTL 30 days; --ttl never for non-expiring)
k8e sandbox-apikey create my-agent
# → {"name":"my-agent","key":"k8e-abc123...","ttl_days":30,"expires_at":"..."}
# 3. Connect: mTLS auth + install the skill into Claude Code / Codex / Pi
./k8e-sandbox-cli-linux-amd64 --endpoint <server-ip>:50051 --apikey k8e-abc123... connectThen ask your agent naturally:
"Run this Python snippet in a sandbox"
The agent executes k8e-sandbox-cli run automatically — no session management needed.
📖 Tutorial walkthroughs, the full command reference, and configuration details live in the Sandbox CLI guide and Sandbox Examples on the official docs site.
| K8E 🚀 | E2B | Daytona | agent-sandbox | DIY gVisor/Firecracker | |
|---|---|---|---|---|---|
| Self-hosted, single binary | ✅ <100MB | ✅ | ❌ needs a K8s cluster | ❌ you build it | |
| Isolation runtimes | ✅ gVisor / Kata / Firecracker — pluggable | Firecracker microVMs | ✅ microVM/containers | K8s RuntimeClass | one runtime |
| E2B SDK compatibility | ✅ native (official SDKs unmodified) | ✅ native | ❌ own API | ❌ | ❌ |
| Warm pool (sub-500ms claims) | ✅ built-in, adaptive sizing | ✅ managed | ❌ | ||
| Per-session network policy (eBPF) | ✅ Cilium, live-configurable | managed (fixed) | hand-written | ||
| License | Apache 2.0 | Apache 2.0 (hosted core paid) | Apache 2.0 | Apache 2.0 | — |
When to choose K8E: you want E2B-style sandboxes but self-hosted, with a rich tool surface beyond "run code" — PTY terminals, snapshots, service exposure, and live egress policy, all through one audited gateway.
git clone https://github.com/<your-username>/k8e.git && cd k8e
git checkout -b feat/my-feature
make && make test
git push origin feat/my-featureReport vulnerabilities via GitHub Security Advisories. Do not open public issues for security bugs.
Apache License 2.0 — see LICENSE.
| Project | Contribution |
|---|---|
| 🐄 K3s | Lightweight Kubernetes foundation that inspired K8E |
| ☸️ Kubernetes | The orchestration engine everything is built on |
| 🔷 Cilium | eBPF-powered networking and per-session egress control |
| 🤖 agent-sandbox | Kubernetes-native agent sandboxing primitives |
| 🌐 CNCF | Fostering the open-source cloud native ecosystem |
k8e.sh — Open Source Agentic AI Sandbox Matrix
If K8E powers your agents, give us a ⭐ — it means the world to us!