Show HN: AgentNest, self-hosted sandboxes for AI agents

The open-source runtime for secure AI agent execution.

AgentNest gives AI agents disposable, policy-controlled environments for Python, shell commands, files, packages, browsers, GPUs, and Git work. It is self-hosted, Python-first, and deliberately not another cloud or cluster orchestrator.

from agentnest import Sandbox

with Sandbox("python:3.12-slim", timeout=60) as sandbox:

sandbox.write_file("main.py", "print('Hello from isolation')")

result = sandbox.exec_shell("python main.py")

print(result.stdout)- Secure defaults: non-root, read-only root, no capabilities, denied networking, limits, cleanup

- Egress allowlisting: let code reach pypi.organd nothing else, with every connection logged

- Agent-native: stateful Python sessions, forkable state, async, streaming, secrets, approvals, audit events

- Non-destructive timeouts: a slow command is killed on its own; the sandbox and its state survive

- Crash-safe: every resource is labelled with a deadline, so agentnest prunereaps orphans

- Proven, not promised: a suite of escape attempts runs on every commit

- Self-hosted & extensible: your Docker or Kubernetes; third-party backends via entry points

Try it in one command (needs Docker):

pip install agentnest

agentnest demoWarning

Containers share the host kernel. Choose an isolation boundary appropriate for your threat model. Read the security model before running hostile multi-tenant workloads.

pip install agentnest

agentnest doctorOptional extras:

pip install 'agentnest[kubernetes]'

pip install 'agentnest[server]'

pip install 'agentnest[mcp]'

pip install 'agentnest[all]'from agentnest import NetworkPolicy, Sandbox, Secret, SecurityPolicy

policy = SecurityPolicy(

network=NetworkPolicy.denied(),

max_output_bytes=2_000_000,

require_image_digest=True,

)

with Sandbox(

"python@sha256:<digest>",

security_policy=policy,

environment={"TOKEN": Secret("redacted-in-output")},

memory="512m",

cpus=1.0,

) as sandbox:

for event in sandbox.stream_shell("python main.py"):

print(event.data, end="")

checkpoint = sandbox.snapshot("workspace.tar")

for artifact in sandbox.artifacts("output/**/*"):

print(artifact.path, artifact.sha256)Give code the network it needs and nothing more. Denied is still the default; an allowlist routes traffic through a filtering proxy that only lets approved domains through.