k8e

k8e.sh — Open Source Agentic AI Sandbox Matrix. A single binary under 100MB that turns any Linux host into a secure, isolated execution platform for AI agents — gVisor, Kata, or Firecracker isolation, warm-pool fast starts, and an E2B-compatible API. Up and running in 60 seconds.

curl -sfL https://k8e.sh/install.sh | sh -

That's it. Your agentic sandbox matrix is ready. 🤖

🤖 What is K8E?

K8E is the Open Source Agentic AI Sandbox Matrix — a self-hosted sandbox platform for running secure, isolated AI agent workloads at scale, packaged as a single binary under 100MB.

As autonomous AI agents increasingly generate and execute untrusted code, robust sandboxing infrastructure is no longer optional. K8E ships everything needed to spin up a production-grade cluster in under 60 seconds, with first-class primitives for agent isolation, resource governance, and persistent execution environments — purpose-built for the AI era.

🔒 One cluster. Many agents. Zero trust between them.

Sandbox Capabilities

📚 Full documentation: k8e.sh/guide — guides, CLI reference, and examples live on the official site.

🏗️ Architecture

 AI Agents (Claude Code / Codex / Pi / dsh)
        │  k8e-sandbox-cli / plugin tools    (gRPC over mTLS)
        ▼
┌──────────────────────────────────────────────┐
│              SANDBOX GATEWAY                 │
│  sessions · exec · files · PTY terminals     │
│  expose · allow-hosts · snapshots            │
│  warm pool · metrics · event stream          │
└──────────────┬───────────────────────────────┘
               │ claims ready pods from the warm pool
   ┌───────────▼───────────┐   ┌────────────────┐
   │   SANDBOX POD         │   │   SANDBOX POD  │
   │   gVisor / Kata / FC  │ … │   (isolated)   │
   │   agent's code + PVC  │   │                │
   └───────────────────────┘   └────────────────┘
        eBPF per-session network policy between all of them

One gateway fronts every operation — session lifecycle, streaming exec, filesystem, PTY terminals, service exposure (expose), live egress policy (allow-hosts) and content-addressed snapshots — so agents get one audited door instead of raw infrastructure access.

🚀 Quick Start

Step 1 — Install a Sandbox Runtime (recommended: before K8E)

gVisor is recommended — no KVM required:

ARCH=$(uname -m)   # x86_64 on most servers, aarch64 on ARM
URL=https://storage.googleapis.com/gvisor/releases/release/latest/${ARCH}

wget ${URL}/gvisor.tar.zstd ${URL}/gvisor.tar.zstd.sha512
sha512sum -c gvisor.tar.zstd.sha512   # must print OK
sudo tar --zstd -xf gvisor.tar.zstd -C /usr/local/bin

K8E detects runsc at startup and automatically injects the gVisor stanza into its containerd config. Do not run runsc install — K8E manages its own containerd configuration.

Need stronger isolation? Kata Containers and Firecracker are covered in the Sandbox Runtime Setup guide.

Step 2 — Install K8E

curl -sfL https://k8e.sh/install.sh | sh -

Step 3 — Verify the Sandbox

k8e-sandbox-cli status        # -> {"available": true, ...}
k8e-sandbox-cli run 'echo hello from the sandbox'

Step 4 — Connect Your AI Agent

Download the standalone sandbox CLI, authenticate, and install the /k8e-sandbox skill into your agent:

# 1. Download (~44MB) — pick your platform suffix
#    k8e-sandbox-cli-linux-amd64 / linux-arm64 / darwin-arm64 / windows-amd64.exe
curl -sLO https://github.com/xiaods/k8e/releases/latest/download/k8e-sandbox-cli-linux-amd64
chmod +x k8e-sandbox-cli-linux-amd64

# 2. Create an API key on the server (default TTL 30 days; --ttl never for non-expiring)
k8e sandbox-apikey create my-agent
# → {"name":"my-agent","key":"k8e-abc123...","ttl_days":30,"expires_at":"..."}

# 3. Connect: mTLS auth + install the skill into Claude Code / Codex / Pi
./k8e-sandbox-cli-linux-amd64 --endpoint <server-ip>:50051 --apikey k8e-abc123... connect

Then ask your agent naturally:

"Run this Python snippet in a sandbox"

The agent executes k8e-sandbox-cli run automatically — no session management needed.

📖 Tutorial walkthroughs, the full command reference, and configuration details live in the Sandbox CLI guide and Sandbox Examples on the official docs site.

🆚 K8E vs Other Sandbox Platforms

When to choose K8E: you want E2B-style sandboxes but self-hosted, with a rich tool surface beyond "run code" — PTY terminals, snapshots, service exposure, and live egress policy, all through one audited gateway.

🤝 Contributing

git clone https://github.com/<your-username>/k8e.git && cd k8e
git checkout -b feat/my-feature
make && make test
git push origin feat/my-feature

• 🐛 Bug Reports
• 💡 Feature Requests
• 🔍 Open PRs

🛡️ Security

Report vulnerabilities via GitHub Security Advisories. Do not open public issues for security bugs.

📄 License

Apache License 2.0 — see LICENSE.

🙏 Acknowledgments