Native local sandbox backend (Linux for now, no cloud dependency)

[john221wick]

Submission checklist

• This is a feature request, not a bug report.
• I searched existing issues and didn't find this feature.
• I checked the docs and README for existing functionality.
• This request applies to this repo (deepagents) and not an external package.

Area (Required)

• deepagents (SDK)
• cli
• acp
• evals
• harbor
• repl
• daytona
• modal
• quickjs
• runloop
• langsmith-sandbox
• Other / not sure / general

Feature description

Deep Agents currently has two options for code execution: LocalShellBackend (zero isolation — agent commands run directly on the host) and cloud sandbox backends (Modal, Daytona, Runloop, LangSmith — require accounts, API keys, and per-second billing).

There's no middle option: a local sandbox backend with actual OS-level isolation that works without any cloud dependency.

For comparison, OpenAI's Agents SDK shipped UnixLocalSandboxClient on April 15, 2026, giving their users exactly this — a built-in local sandbox client that provides isolated execution out of the box, no infrastructure setup required.

Deep Agents should have an equivalent. A user should be able to do:

from deepagents import create_deep_agent
from sandy import Sandbox

agent = create_deep_agent(model=..., backend=Sandbox())

and get isolated local execution with filesystem restrictions, network filtering, and resource limits — without signing up for anything.

Proposed solution (optional)

Proposed solution:

I've built deepagents-sandbox — a BaseSandbox implementation that provides native Linux process isolation as a Deep Agents backend, with zero cloud dependency.

Package: https://pypi.org/project/deepagents-sandbox/
Source: https://github.com/john221wick/deepagents-sandbox

How it works

deepagents-sandbox implements the BaseSandbox protocol using Linux-native isolation primitives:

• Filesystem isolation: Sandboxed workspace with restricted read/write paths — agent code cannot access host sensitive files
• Network filtering: Configurable domain allowlists to prevent unauthorized outbound connections
• Resource limits: CPU, memory, and PID constraints via cgroups v2
• Process isolation: Linux namespaces and seccomp BPF filters

Usage

from deepagents import create_deep_agent
from deepagents_sandbox import Sandbox

# One line — isolated local execution, no API keys, no cloud account
backend = Sandbox()
agent = create_deep_agent(model="anthropic:claude-sonnet-4-6", backend=backend)

result = agent.invoke({
    "messages": [{"role": "user", "content": "Write and run a Python script that processes data.csv"}]
})

What's implemented

• execute(command) → runs commands inside the isolated sandbox, returns ExecuteResponse with stdout/stderr and exit code
• upload_files(files) → copies files into the sandbox workspace
• download_files(paths) → retrieves files from the sandbox workspace
• id property → stable unique identifier per sandbox instance

All other BaseSandbox operations (read, write, ls, grep, glob, edit) work automatically since they're built on top of execute().

Scope and limitations

• Linux-only for now (same constraint as OpenAI's UnixLocalSandboxClient)
• Requires bubblewrap (bwrap) or unprivileged user namespaces on the host
• Not a replacement for cloud sandboxes in multi-tenant production — this is for local development, CI, single-tenant deployments, and air-gapped environments

Contribution path

Happy to contribute this as a partner integration under libs/partners/sandbox/ following the same structure as langchain-daytona, langchain-modal, and langchain-runloop. Also fine keeping it external with a docs listing — whatever the maintainers prefer.

Additional context (optional)

No response