Open-source · Apache 2.0 · self-hostable

A sandbox for AI agents — one real Linux box per agent.

Give every AI agent its own isolated Linux box — real root, real filesystem, real network — with an MCP server built in. Run untrusted agent code safely, off your laptop. Self-host the open source on your own VM, or skip the ops with the hosted cloud.

Try Containarium Cloud — free tier Self-host the open source

Works with the agents you already use — bring your own.

Claude Code Cursor Cline OpenCode your own agent

~ / containarium

$ containarium create my-agent-box
✓ isolated LXC box my-agent-box created
✓ reachable at my-agent-box.example.com
✓ MCP server listening inside the box

# Point any agent at it — Claude Code, Cursor, Cline…
$ claude --mcp my-agent-box.example.com
Connected. Your agent has its own box.

Why a sandbox

Don't let an agent run on your laptop.

An autonomous agent runs shell commands, installs packages, and executes code you didn't write. On your machine that's a blast radius. In a Containarium box it's contained — disposable, isolated, and yours to tear down.

Isolated Linux box per agent

One LXC container per agent. Real root, real filesystem, real network — sandboxed from your host and from every other tenant. Run untrusted agent code without putting your machine at risk.

MCP server inside every box

A built-in MCP server exposes shell + file operations over stdio. Any MCP-aware agent drives it — Claude Code, Cursor, Cline, or your own.

Persistent across sessions

A box is long-lived, not an ephemeral function. Caches, installed tools, and working state survive between agent runs — until you delete the box.

How it works

From agent to box, in one command.

STEP 1

Create a box

containarium create spins up an isolated LXC box and gives it a routable hostname with TLS.
STEP 2

Point your agent at it

The box runs an MCP server. Your agent connects over SSH or HTTPS — by hostname. No plumbing.
STEP 3

Let it work

The agent edits files, runs commands, and ships code — inside an isolated environment you control and can throw away.

Why Containarium

The only agent sandbox you can fully self-host.

Most agent sandboxes are hosted-only — your code and data leave your perimeter by design. Containarium's core is open source, so you decide where the box runs.

Open source, Apache 2.0

CLI, daemon, sentinel, and in-box MCP server are all open. No CLA. A self-hosted, open-source alternative to hosted-only sandbox providers.

Your infra or ours

Run it on your own VM to keep agent code inside your network, or use the hosted cloud for zero ops. Same primitive underneath.

Real box, not a function

A full Linux environment with root, persistent disk, and a real network — not a stripped-down serverless runtime that resets every call.

Bring your own agent

MCP-native, so Claude Code, Cursor, Cline, OpenCode, and custom agents all work. No vendor agent lock-in.

Routable hostname + TLS

A built-in sentinel gives each box an HTTPS hostname and SSH routing. Reach the agent's box from anywhere.

One box per task or tenant

Scale to a fleet: a box per agent, per task, per user. The sentinel handles routing; you handle the agent.

Compare: Containarium vs E2B

Open source

Don't take our word for it. Read the code.

Containarium's core is Apache 2.0 — clone it, audit it, and run it on your own VM tonight. No sign-up, no sales call, no black box.

Star on GitHub

Apache 2.0 No CLA MCP-native Self-hostable

Watch the 55-second demo

Prompt → a live HTTPS app in a box, end to end.

See a live box

A real Containarium box serving on the open internet.

"Every project gets its own VM, so nothing steps on anything else — that's the biggest win for me."

Setup couldn't be simpler: install the CLI, log in, and you have a dedicated dev environment — and most of the work after that, you can hand to the agent. What I feel the most is driving it over MCP: my coding agent deploys, tails logs, checks service status, and runs tests right on the VM, so I'm not SSH-ing in by hand every time. It takes out a huge amount of the repetitive deploy-and-verify work. I can even push a single branch to its own isolated VM and validate it there — long before it merges to main.

Ying · solo AI developer

FAQ

Common questions

What is a sandbox for AI agents?

An isolated environment where an autonomous coding agent can run commands, edit files, and call tools without touching your laptop or other tenants. Containarium gives each agent its own real Linux box — full filesystem, root, and network — sandboxed from the host.

How do I run untrusted AI agent code safely?

Run it in a disposable, isolated container instead of on your machine. Containarium spins up one LXC box per agent, isolated from the host and every other tenant, with optional eBPF network egress controls. Tear the box down when the task is done.

Is Containarium a self-hosted, open-source E2B alternative?

Yes. The core — CLI, daemon, sentinel, and in-box MCP server — is open source under Apache 2.0 and runs on your own VM. Unlike hosted-only sandbox providers, you can keep agent code entirely inside your own infrastructure, or use the hosted Containarium Cloud if you'd rather not run ops.

Which AI agents work with Containarium?

Any MCP-aware agent. Each box runs an MCP server exposing shell and file operations over stdio, so Claude Code, Cursor, Cline, OpenCode, and custom agents can all drive it. You bring the agent; Containarium provides the box.

Does the agent's environment persist between sessions?

Yes. A box is a long-lived container, not an ephemeral function. Caches, installed tools, and working state survive across agent sessions until you delete the box.

Give your agent a real box.

Start free on the hosted cloud, or clone the open source and run it on your VM tonight.

Start with Cloud Read the OSS source