raymondfeng/sandbox-preview

cs-sandbox is a single-script tool that gives you disposable, isolated Linux environments for letting AI coding agents like Claude Code and Codex work on your code without touching anything else on your computer. The core workflow is simple: create a sandbox, share specific repositories into it, let the AI agent do its work, pull the changes back out, then throw the whole thing away. Each sandbox is a fresh Linux environment with modern development tools and the AI agents already installed. Nothing on your host is shared by default, you explicitly choose which repos go in, and the sandbox can't reach back into your machine. Sandboxes can also talk to each other over a shared network by name, which means you can have one AI agent delegate work to another agent in a separate sandbox. The tool supports two engines for creating these sandboxes. Podman is lighter and faster, good for everyday work, but shares some of your computer's underlying system. Firecracker creates a more deeply isolated environment with its own operating system kernel, which is better when you're running untrusted or autonomous work. Both work the same way from your perspective, you just pick which one to use. This is useful for anyone running AI coding agents but worried about what those agents might do on their machine. A developer could spin up a sandbox, hand Claude Code a repo to work on with no approval prompts (the sandbox itself is the safety boundary), fetch the commits back, and destroy the sandbox in minutes. You could also have one agent drive another, for example, Claude in one sandbox telling Codex in another to implement a feature, all without either agent touching your actual development environment. The security model is thoughtful: sandboxes meant for AI agents never get your SSH keys, and can't access sandboxes that do hold them. The project is open source under Apache 2.0 and runs on both Linux and macOS.