isola
Self-hosted Kubernetes sandboxing platform
What is it?
What it is
An open-source platform for running untrusted and AI-generated code securely on Kubernetes using gVisor sandboxing.
Why it exists
To provide a secure, self-hosted, and Kubernetes-native way to execute arbitrary code via a REST API and SDKs, featuring filesystem snapshots and configurable network isolation.
Who should use it
AI engineers building autonomous agentsDevelopers building code interpreters or online IDEsPlatform engineers needing secure multi-tenant execution environmentsDevOps teams requiring sandboxed command execution on Kubernetes
Who should avoid it
Users looking for a managed SaaS solutionTeams without access to a Kubernetes clusterUsers requiring full VM-level hardware virtualization (e.g., Firecracker)Developers who cannot manage or configure gVisor runtimes
How it works
A quick walkthrough in plain English
How isola works
Step 1 of 3
You interact with it
Open isola, send a request, or connect it to your stack.
Features
Advantages
- Open-source Apache 2.0 licensed for full control and auditing
- Self-hosted on Kubernetes cluster with no external dependencies
- Kubernetes-native integration via Custom Resources and operator
- Strong security via gVisor application-layer isolation
- Efficient rootfs snapshots with minimal storage overhead
- Flexible network policies with egress rate limiting
- Multi-language SDKs (Python, TypeScript) and REST API access
Disadvantages
- Requires Kubernetes cluster with gVisor RuntimeClass configured
- Cloud storage dependency for rootfs snapshots (S3/GCS/Azure)
- Network isolation may require specific CNI support
- Resource limit summation issues in multi-container setups
- Egress rate limiting requires gVisor release 20260615.0+
Installation
cloud
Install with Helm: `kubectl create namespace isola-sandboxes` and `helm install isola oci://ghcr.io/isola-run/charts/isola --namespace isola-system --create-namespace`
native
run `hack/setup.sh` to get a local development cluster with Kind.
FAQ
What are the prerequisites for deploying Isola?
A Kubernetes cluster, Helm, a gVisor RuntimeClass configured in the cluster, and optionally an object storage bucket for rootfs snapshots.
How do I set up a local development environment?
Run `hack/setup.sh` to create a local Kind cluster with gVisor and a local registry, then use `tilt up` to start the dev environment.
How are rootfs snapshots enabled and used?
Enable via Helm values (`operator.sandboxRuntime.rootfssnapshot.enabled: true`) and configure storage (S3/GCS/Azure). Snapshots capture filesystem changes for reuse across sandboxes.
Can I restrict network access for sandboxes?
Yes. Configure `network=Network(allowed_egress_cidrs: [...])` or `allow_internet_egress: true` per sandbox to control egress traffic.
Which programming languages are supported via SDKs?
Python (sync/async) and TypeScript (Node, Bun, Deno) SDKs are available. The REST API can also be used directly for other languages.
How does Isola ensure security?
Isola uses gVisor for strong isolation via user-space system call interception. It's self-hosted, avoiding third-party services, and sandbox resources are managed via Kubernetes RBAC.
Featured in Videos
YouTube tutorials and walkthroughs for isola
Alternatives
Similar projects ranked by category, topics, and text overlap.
