Kern Sandbox
getkern.dev- Category
- Developer Tools
- Rank
- No. 1127Tools index
Previous survey · No. 1119 ·
- Type
- TOOL
- Use case
- Agent Building
- GitHub
- 466 stars
- Latest release
- v0.33.0
- Date
About
Kern Sandbox is a rootless, daemonless container runtime that runs LLM-generated code from Python or Node inside a fresh, disposable OCI container per call, with no network access, memory/PID caps, and an external deadline, discarding the container afterward. It also supports a persistent workspace and a warm interpreter for state that needs to carry across steps, aimed at agents that write and execute code in a loop.
What it does
One static Linux binary that starts isolated boxes in a few milliseconds and doubles as a place to execute scripts a model wrote. A Python or JavaScript package wraps it in a single call that returns output, exit status and a typed fault field saying whether a timeout, an out-of-memory kill or the script itself ended the run. The same binary also runs ordinary images and compose stacks, and ships a stdio MCP (Model Context Protocol) server so Claude Code, Cursor and similar clients can hand it work.
Why it's ranked here
The isolation claims come with their limits written down. The threat model separates kernel-enforced boundaries from cooperative governors, names the egress allowlist's shared-CDN hole, and says plainly that hostile multi-tenant code belongs in a microVM. The fault field is read from a pipe the runtime writes, so printed text cannot fake a clean exit. Apache 2.0, an isolation crate whose only dependency is libc, and a pentest suite that checks boundaries against the kernel make this a serious option for running agent code locally.
What's good
Safe defaults are refusals, not warnings. Mounts over seventeen named credential directories, such as the SSH and AWS folders, are rejected even when asked for, and every relaxation is a named argument. The MCP server rejects unknown tool arguments instead of dropping them, and stamps each reply with the runtime that ran it, so a client cannot claim a call that never happened. Prewarmed boxes cut a call to under two milliseconds without changing what the call gets. Snapshots carry a session's files to another machine.
Tradeoffs
Linux only: Windows needs WSL2, macOS needs a Linux VM, and the bundled binary arrives with the Python package only on x86_64 and aarch64. It shares the host kernel, so a kernel privilege escalation is an escape. Memory and process caps bind only where the host delegates cgroups, which stock Raspberry Pi OS and default WSL2 do not. The workspace has no size cap by default, and one cell wrote about eight gigabytes in ten seconds. The default MCP image is 145 MB, so the first call on an empty cache waits over twenty seconds.
How to use it well
Fits a developer running an agent's generated scripts on their own Linux machine, or on a Linux host reached over ssh from a Mac or Windows client. Start with one-shot calls and move to a kept-open sandbox or the warm kernel only when state must carry between steps. Set a workspace size cap and a short timeout. Install packages through the one-time setup step rather than the egress allowlist, which for PyPI effectively opens all of Fastly. For hostile code from strangers, use Firecracker, Kata or gVisor instead.
Technical notes+
Cargo.toml defines a five-crate Rust workspace with a size-optimised release profile, and its comments record that codegen choice was re-measured and found to be under 1.5% of a box start. Per ARCHITECTURE.md and crates/kern-isolation/src/lib.rs, mount steps go through a MountOps trait with a Recorder implementation for privilege-free tests, and a Rootfs typestate makes remounting read-only before pivot_root a compile error. crates/kern-cli/src/main.rs routes every environment read and write through one chokepoint that asserts a test lock. docs/EGRESS.md describes egress as a pump in the box netns relaying over a UNIX socket to a host proxy that tunnels only ports 80 and 443.
Observed
- License
- Apache-2.0
- Language
- Rust (Cargo workspace)
- Packaging
- kern-sandbox on PyPI and npm; shell install script for the binary
- Interfaces
- CLI, Python SDK, Node SDK, stdio MCP server (kern-mcp)
- Platform support
- Linux x86_64 and aarch64; Windows through WSL2; macOS through a Linux VM
- Isolation mechanism
- User, PID, net, mount, UTS and IPC namespaces, seccomp allowlist, cgroup v2 limits
- Daemon
- None; one static binary
Read from README.md, Cargo.toml, ARCHITECTURE.md, docs/SANDBOX.md, docs/THREAT_MODEL.md, docs/MCP.md, docs/EGRESS.md, crates/kern-cli/src/main.rs, crates/kern-isolation/src/lib.rs.
Tags
Tech Stack
Media
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.