Sandseal
Open beta — every feature free, no card

Run AI agents in
isolated sandboxes

Sandseal drops your coding agent into a Docker container with your project mounted and your secrets hidden. One command, no account, no telemetry — the CLI is open source and works entirely offline.

$curl -fsSL https://sandseal.io/install.sh | bash

Linux and macOS. On Windows run it inside WSL2.

How to installSource on GitHub
$ sandseal start
 INFO starting sandbox for /home/you/code/checkout-api
 INFO building sandbox image for /home/you/code/checkout-api
  Built image: sandseal-sandbox/agent-claude-checkout-api
 INFO memory enabled for this session
 INFO container is running, attaching...

Install

Two commands from nothing to an agent running in a container.

Docker

The installer checks for it and offers to set it up if it is missing.

Linux or macOS

x86_64 and arm64. On Windows run everything inside WSL2.

No account

Nothing to sign up for, no license key, no telemetry.

  1. 1

    Install the CLI

    $curl -fsSL https://sandseal.io/install.sh | bash

    Downloads the binary for your platform, verifies its SHA256 against the published SHA256SUMS, puts it on your PATH and checks that Docker is usable. Re-running it upgrades in place.

  2. 2

    Start a sandbox in any project

    $cd ~/code/my-project
    $sandseal start

    Builds the sandbox image, mounts the project at its host path, hides the files you excluded and drops you into the agent. The path is optional — pass one (sandseal start ~/code/other) to run a sandbox for a different project without leaving this one.

  3. 3

    Optional: connect the dashboard

    $sandseal login

    Only needed for the online features — remote access, shared memory and session history. Everything above runs without it.

Installer options

Pass flags through to the script after --, or print them with --help.

$curl -fsSL https://sandseal.io/install.sh | bash -s -- --help
--version X.Y.Z
install a specific version
--dir PATH
where the binary goes (default: ~/.local/bin)
--no-modify-path
do not touch shell rc files
--with-docker
install Docker without asking
--no-docker
never install Docker
--yes
answer every prompt with yes

Uninstall

Removes the binary, the assets and the shell rc entry it added.

$curl -fsSL https://sandseal.io/uninstall.sh | bash

Upgrade

Runs the same installer and verifies the download against SHA256SUMS. --version X.Y.Z also downgrades.

$sandseal update

Or build from source

A Cargo workspace in apps/cli — the binary lands in target/release/sandseal.

$cargo build --release

Everything you need for safe AI development

Isolated sandboxes

One container per project. The agent runs as a non-root user with your UID, so file permissions keep working and nothing outside the mounts is reachable.

File access control

Hide .env files, credentials and whole directories behind /dev/null mounts. Mount extra host paths in read-only when the agent genuinely needs them.

Configuration profiles

Named presets — night, review, untrusted — switched per project. Layers only ever tighten: a project cannot re-open what a profile closed.

Host networking

network_mode: host by default, so the agent reaches your dev server and your database. Map service hostnames to host IPs, or drop to bridge mode.

Dependencies and hooks

APT packages baked in at build time, scripts at setup, prestart and around the sandbox on the host. The agent home volume survives restarts.

Remote access

Bridge a running sandbox to the dashboard and drive the agent from a browser or a phone. Terminal traffic is end-to-end encrypted; the relay only forwards ciphertext.

The CLI is open source

Everything that touches your code — the sandbox, the file access control, the profiles, the hooks — lives in a public repository under Apache 2.0. Read it, fork it, build it yourself.

It also runs on its own. There is no license key and no usage check: the binary holds no credential until sandseal login writes one, so on a machine that never logged in, nothing about your projects leaves it. Sandseal ships no telemetry and no background update check.

qwxxn/sandsealDocumentationApache 2.0

Works offline, no account

  • start, build, destroy, status
  • config and profiles
  • file exclusions, inclusions, workspaces
  • hooks, dependencies, service endpoints

Requires sandseal login

  • memory — recall shared across sandboxes
  • connect, pair, chat — drive a sandbox from the dashboard
  • start --remote
  • whoami

Online features degrade instead of failing. Not logged in, no subscription or sandseal.io unreachable means a sandbox without memory — never a sandbox that refuses to start.

Simple pricing

The CLI is free forever. Everything else is free too while the open beta runs — the prices below are what starts once it ends, and nobody gets charged without hearing about it first.

Free

$0the open-source CLI
  • Docker sandbox isolation
  • File access control
  • Configuration profiles
  • Custom dependencies and hooks
  • Works offline, no account
Install the CLI

Pro

Free in beta
$12per month
  • Everything in Free
  • Remote access dashboard
  • E2E encrypted sessions
  • Memory shared across sandboxes
  • Session history
  • Config sync and templates
Get started free

Team

After the beta
$28per seat / month
  • Everything in Pro
  • Organization management
  • SSO (SAML)
  • Audit log
  • Shared templates
  • Security policies
Join the beta

During the beta every account runs on Pro. Team seats — orgs, SSO, audit log — open when billing does.

Put your agent in a box

No account, no telemetry, no license key. Install it and run sandseal start in the project you are working on.

$curl -fsSL https://sandseal.io/install.sh | bash