Arrakis
by Arrakis (open-source project by Abhishek Bhardwaj)
Self-hosted microVM sandboxes for AI agents, with snapshot and restore.
Arrakis is an open-source, self-hostable sandboxing service that runs AI agent code and computer-use tasks inside Cloud Hypervisor microVMs on your own Linux hosts. It suits engineering teams that want isolated, snapshot-able agent environments without sending code to a hosted sandbox provider.
Arrakis is an open-source sandboxing service for AI agents, released by Abhishek Bhardwaj, an infrastructure engineer who previously worked at Replit, Google and Microsoft, and launched on Hacker News in April 2025. Each sandbox is a microVM run by Cloud Hypervisor, the Rust-based virtual machine manager, booting Ubuntu with a code execution service, a VNC server for GUI access and a preinstalled Chrome browser for computer-use agents. Networking runs through a tap device on a Linux bridge, the root filesystem is protected with overlayfs, and ports are forwarded automatically from the host. Its distinguishing feature is snapshot and restore: an agent can save a sandbox's state, including GUI state, and backtrack to it after a failed step in a multi-step task. The system has two parts, arrakis-restserver, a daemon that manages VM lifecycle, and arrakis-client, a CLI. Developers drive it through a REST API, the py-arrakis Python SDK (MIT licence, version 2.0.0 published May 27, 2025) or an MCP server that connects Claude Desktop, Cursor and Windsurf. Sandbox images can be customised with Docker. Arrakis needs a Linux host with /dev/kvm. The server is licensed under AGPL-3.0, with commercial licences available from the author. At the time of research the repository had about 885 stars and 89 forks, its last commit and release dated June 2, 2025, and it appears in Hacker News roundups of agent sandboxes alongside E2B, Modal and Daytona.
A platform or ML infrastructure engineer who needs to run untrusted agent-generated code on in-house Linux servers and is comfortable maintaining an open-source component.
Agent code and browser sessions run in isolated microVMs on your own hardware, and agents can roll back to a saved snapshot after a bad step.
At a Glance
- Category
- Infrastructure & Cloud
- Pricing
- Free, Contact for pricing
- Target Market
- Platform Engineers, ML Engineers, Enterprise Developers, AI Researchers
- Deployment
- Self-hosted, Open-source
- Founded
- 2025
Key Features
- ✓Cloud Hypervisor microVMs
Each sandbox runs in its own microVM, isolating agent code from the host and from other sandboxes more strongly than shared-kernel containers.
- ✓Snapshot and restore
Saves full sandbox state, including GUI state, so an agent can backtrack to a known point after a failed step.
- ✓Computer-use environment
Ubuntu guests ship with Chrome and a VNC server, giving browser and desktop agents a full GUI to operate.
- ✓REST API and Python SDK
The arrakis-restserver API and the py-arrakis SDK let developers create, snapshot and destroy sandboxes programmatically from Python 3.9 and later.
- ✓MCP server
Exposes sandboxes to Claude Desktop, Cursor and Windsurf through the Model Context Protocol, so assistants can run code in isolation.
- ✓Docker-based image customisation
Sandbox root filesystems can be built from a Dockerfile, letting teams preinstall the languages and tools their agents need.
Capabilities
Use Cases
- •Safe code execution for coding agents
A coding agent runs generated scripts inside a microVM, so a destructive command damages only a disposable sandbox rather than the host.
- •Browser automation agents
A computer-use agent drives Chrome inside the sandbox while engineers watch over VNC, keeping web sessions off developer machines.
- •Backtracking in long agent tasks
The agent snapshots the environment before a risky step and restores it if the step fails, instead of rebuilding the environment from scratch.
- •Self-hosted alternative to hosted sandboxes
Teams with data-residency or cost concerns run sandboxes on their own KVM servers instead of sending code to a hosted sandbox provider.
Ideal For
Best For
- ✓Executing LLM-generated code in hardware-isolated microVMs on self-managed Linux servers
- ✓Computer-use agents that need a full Ubuntu desktop with Chrome and VNC access
- ✓Multi-step agent workflows that benefit from snapshotting state and backtracking after errors
- ✓Giving Claude Desktop, Cursor or Windsurf a sandbox through an MCP server during experiments
Not Ideal For
- ✗Teams that need an actively maintained product or vendor support: the repository's last commit and release were on June 2, 2025
- ✗Organisations without Linux hosts that expose /dev/kvm, such as many nested-virtualisation cloud instances, Mac or Windows workstations
- ✗Companies whose legal policy rules out AGPL-3.0 server software and that do not want to negotiate a commercial licence with an individual author
Integrations
Deployment
Market Analysis
Pros
- ✓MicroVM isolation via Cloud Hypervisor is stronger than container-only sandboxes
- ✓Snapshot and restore support agent backtracking, which commenters on the Show HN thread called out as useful
- ✓Free to self-host, with a REST API, Python SDK and MCP server already built
Cons
- ✗Development has stalled: the last commit and release on GitHub are dated June 2, 2025
- ✗Linux-only and requires /dev/kvm, which rules out many cloud VMs without nested virtualisation
- ✗AGPL-3.0 licensing and a single maintainer make it a hard sell for enterprise procurement
- ✗Little independent production feedback: the Show HN thread drew only a handful of brief comments and no technical critique
Pricing
Open source (AGPL-3.0)
$0
- ✓Self-hosted restserver and CLI
- ✓Python SDK (MIT)
- ✓MCP server
- ✓Snapshot and restore
Commercial licence
Contact for pricing
- ✓Non-AGPL licensing arranged directly with the author
Arrakis itself is free under AGPL-3.0 and the Python SDK is MIT; the real cost is the Linux KVM hardware you run it on and the engineering time to operate it. Commercial licensing is available by emailing the author, with no published price.
Security & Compliance
Connect
Sources
This page was written from 5 sources, 3 on domains other than github.com.
Stay Ahead of the Curve
Weekly enterprise AI insights for technology leaders. No spam, no vendor pitches—unsubscribe anytime.
SubscribeRelated Products
Ollama
Run open-weight LLMs locally with one command, then burst to Ollama's cloud on the same API
Inferact Platform
Managed vLLM inference from the creators of vLLM, on your own GPUs or on Inferact Cloud
Perplexity SPACE
Open-source Firecracker microVM sandbox for AI agents, the Apache 2.0 runtime behind Perplexity Computer
Gimlet Cloud
Multi-silicon inference cloud that splits AI agent workloads across GPUs, CPUs and accelerators