Open, and actually yours
Zoo is open source and self-hosts on Ubuntu or Debian with usable KVM and the pinned Kata stack — no BYOC sales call, no enterprise tier, no data leaving your racks. Secrets encrypt with your keys, or your own KMS.
compare / the 2026 field
Sixteen sandboxes, one table
Zoo next to the platforms it competes with — on the things that are hard to fake: open source or not, what actually isolates each sandbox, how agent-native it feels, and whether any of it can run on your own hardware.
| sandbox | open source | core isolation | agent focus | self-host |
|---|---|---|---|---|
| Zoo this site | yes | Kata Linux VMs; native macOS and Hyper-V guests | ★★★★★ | yes — one command |
| E2B | yes | Firecracker microVM | ★★★★★ | enterprise / byoc |
| Daytona | partly / changing | Containers / VM options | ★★★★★ | yes |
| Modal Sandboxes | no | gVisor | ★★★★★ | no |
| Runloop | no | VM-based | ★★★★★ | no |
| Blaxel | no | Sandboxed compute | ★★★★★ | no |
| Vercel Sandbox | no | Firecracker | ★★★★★ | no |
| Cloudflare Sandbox SDK | no | Containers / VM isolation | ★★★★★ | cloudflare |
| Fly.io Sprites | no | Firecracker-style VM infra | ★★★★★ | fly.io |
| Northflank | no | Containers / VM infrastructure | ★★★★★ | yes / byoc |
| Freestyle | no | Sandboxed compute | ★★★★★ | cloud |
| CodeSandbox SDK | no | Firecracker microVM | ★★★★★ | no |
| AWS Bedrock AgentCore | no | Dedicated microVM | ★★★★★ | aws |
| Google Agent Sandbox | open components | gVisor / Kubernetes | ★★★★★ | gcp / k8s |
| Qovery | no | Kubernetes isolation | ★★★★★ | yes |
| OpenSandbox | yes | Docker / K8s + pluggable runtimes | ★★★★★ | yes |
| microsandbox | yes | libkrun microVM | ★★★★★ | yes |
Summarized from each vendor's public documentation, October 2026. “Agent focus” is an editorial rating of how agent-native the platform feels. Marks and logos belong to their owners and appear here for identification only.
the short version
A kernel per sandbox
Linux sandboxes use Kata VMs; native Mac and Windows hosts use Virtualization.framework and Hyper-V. Guest screen traffic is relayed by the native gateway, not a public desktop port.
Whole desktops, not just shells
Linux, macOS and Windows desktops with Firefox, plus browser-only and headless code sandboxes, and every tool speaks MCP, REST and SDK.