Kernel-enforced isolation
Runs agents and shell commands inside compartments enforced directly by the operating system kernel rather than by the interpreter.
BentoBox
BentoBox is a kernel-level sandbox for coding agents and commands on Linux and macOS, with deny-by-default compartments to block sensitive files and access.
What BentoBox does and why it exists
BentoBox is a kernel-level sandbox for running coding agents and other commands inside compartmentalized execution environments. The README describes it as a way to sandbox an AI agent in seconds with zero setup and zero startup latency, using kernel enforcement instead of interpreter-level controls.
The product is built around deny-by-default compartments. An agent can work in its assigned workspace and any paths or permissions you explicitly grant, while access to credential files, arbitrary system paths, network access, and other resources remains blocked unless a policy allows it. The repository also documents Python and TypeScript SDKs over a Rust core, plus specialized behavior modules such as credential proxying, snapshots, and output compression.
Core capabilities
Permission-based sandboxing
Uses deny-by-default access rules so worktrees can be opened while unapproved paths, credentials, and other sensitive areas stay blocked unless explicitly allowed.
Compartment workflows
Supports named compartments with their own permissions, resource limits, and message routes, allowing separate steps such as fetch, build, and deploy.
Filesystem and network policy controls
Provides control over filesystem, process, and network access, including full network access or localhost-only per box.
Snapshots and rollback
Includes hash-based snapshots and rollback so changed files can be restored and deleted files can come back.
Multi-language SDK surface
Offers Python and TypeScript wrappers over a single Rust core, with examples shown in the Python README and SDK documentation.
Where BentoBox fits
Isolate coding agents from secrets
Use BentoBox when you want to run a coding assistant against a repository without giving it free access to SSH keys, cloud configs, or other credentials outside the assigned workspace.
Stage multi-step automation pipelines
Use named compartments to split a workflow into fetch, build, and deploy stages, with different filesystem and network permissions for each step.
Sandbox development tasks
Run builds, tests, or package commands in a constrained environment where the command can read what it needs but cannot write broadly or access the network unless allowed.
Recover changed files after a run
Use the snapshot and rollback behavior when you want file changes made during a run to be restorable, including files that were deleted during execution.
Embed sandboxing in application code
Use the Python SDK or TypeScript wrappers when you want to integrate the sandbox into code that already runs in one of those languages rather than invoking a standalone tool only.
Pros and Cons
Pros
- Kernel-level enforcement is the central design, which the README says cannot be loosened once applied, only tightened.
- Deny-by-default access helps keep credentials and other sensitive files blocked unless they are explicitly granted.
- Named compartments make it possible to model multi-step pipelines instead of only single-command sandboxing.
- Snapshots and rollback provide a recovery path for changed or deleted files.
- Python and TypeScript wrappers make the core usable from more than one language.
Cons
- The README indicates Linux support through Landlock and macOS support through Seatbelt, so platform coverage is not universal in the source.
- The documentation is technically detailed, but the product is self-hosted/open-source repository software rather than a hosted service with documented onboarding or managed pricing.
- The security model and workflow are powerful but require defining compartments, permissions, and routes, so setup is more involved than a single-command wrapper.
FAQ
What platforms does BentoBox support?
BentoBox is designed to run agents or agent-launched commands inside kernel-enforced compartments. The README highlights Linux support through Landlock and macOS support through Seatbelt.
Does BentoBox have SDKs?
The README shows Python usage with the bentoworks package and also says there are Python and TypeScript wrappers over a Rust core.
Can BentoBox handle multi-step workflows?
Yes. The source includes an example of a multi-compartment pipeline where one compartment passes work to another using edge() and box.run(entry=...).
How does BentoBox control access?
BentoBox uses deny-by-default policies. A compartment only gets access to the permissions it is explicitly granted, such as fs_read, fs_write, fs_exec, or network.
Is there public pricing information for BentoBox?
The README does not present hosted pricing for BentoBox itself. The repository is public on GitHub, and the product is described as a sandbox you run through its own runtime and SDKs.
Quick Facts
- Category
- Developer Tool
- Source domain
- github.com
- Primary runtime
- Rust core with Python and TypeScript SDKs
- Supported environments
- Linux (Landlock) and macOS (Seatbelt)
- Security model
- Deny by default
- Repository status
- Public GitHub repository
BentoBox Alternatives
ByteAsk
ByteAsk is a terminal-first AI coding agent for C and C++ that edits repos and verifies changes with compilers, debuggers, sanitizers, and tests.
Manta AI
Manta AI is an autonomous web app testing tool that maps app behavior, catches regressions, and generates tests from a URL, no scripts or selectors needed.
CreateOS Sandbox
CreateOS Sandbox is an isolated compute environment for running code and agent workloads in Firecracker micro-VMs with private networking and SDK, CLI, or MCP control.
hob
hob is an independent workspace for coding agents, with local control over sessions, terminals, history, routing, and follow-up work.
SonOf
SonOf connects to your repo and PM tool, audits your codebase, and turns approved work into shipped tickets with senior engineering review.
Ghost
Ghost is a terminal-based AI assistant for chatting, code generation, and CLI tasks. Includes free models, supports Linux, macOS, Windows, and is open source.