Apache-2.0 · self-hosted · one daemon
Sandboxes for AI agents, on the Mac Mini you already own.
Every agent gets its own isolated sandbox: the provider API key never enters it, spend stops at a hard cap, and nothing survives teardown. Run as many as your hardware allows — Linux and bare metal too.
Apache-2.0 · no lock-in · any Mac, Linux VM, or bare-metal box
Terminal transcript. Running hotcell with no arguments opens the home menu: view or manage sandboxes, create a sandbox, manage provider keys, daemon setup, quit. Choosing "Create a sandbox" starts the guided create. Base image: hotcell-base. Clone a repo: https://github.com/sinameraji/hotcell. Create a new branch after cloning: yes, auto-named. One sandbox. Wire keyless egress through the gateway: yes. Install OpenCode, ready to run: yes. The wizard prints the equivalent command — hotcell create --repo https://github.com/sinameraji/hotcell --branch auto --egress --opencode — then provisions through three phases: starting, cloning repo, running setup. Result: sandbox 476e2c427831 created on the container driver, the repo cloned into /workspace on a new auto-named branch, OpenCode installed and ready. Then two commands show the keys are not the same string: on the host, hotcell keys ls lists the openrouter key as sk-or…39, held in the keychain; inside the cell, hotcell exec 476e2c427831 "env | grep OPENROUTER" prints a gateway base URL and OPENROUTER_API_KEY=hc-9c866a01…, a revocable per-sandbox token. The real provider key never enters the sandbox.
Runs your agents — Claude Code · Codex · OpenCode · Mastra
Isolation tiers: Docker · Firecracker · Apple VZ
parallel operations
5 agents, 1 repo, 0 cleanup.
One command, 5 isolated cells — each with the same repo cloned into its own workspace, checked out on its own branch (feat-1 … feat-5), and your agent preinstalled. Open a terminal per cell and put each agent on a different task — OpenCode, Codex, Claude Code, mix them. No git-worktree juggling, no branches colliding, no leftover state: each cell holds its own scoped token with its own spend cap, git push works keylessly through the gateway, and one command tears down every workspace and revokes every token in the same step.
$ hotcell create -n 5 --name feat --branch --egress \
--repo https://github.com/me/app --setup "npm i -g opencode-ai"
$ hotcell terminal <id> # inside: cd app && opencode
$ hotcell # the whole fleet: attach · pause · live cost
$ hotcell rm --all # done — 5 cells gone, your repo untouchedfailure modes
You want to run untrusted agent code at scale. 2 things bite immediately.
Credentials
Put your real API key in the sandbox and a prompt injection, a leaked log, or a malicious dependency can read it and walk off with full account access.
Blast radius
An agent that goes wrong can spend unboundedly, or phone your data out to anywhere on the internet.
Prompt-only defenses fail. Containment is enforced at the infrastructure layer or it isn't enforced at all.
containment model
Every model call out of a sandbox flows through one chokepoint.
Code can't touch the host
Per-sandbox isolation with 3 drivers behind one interface: Docker containers for speed and density, plus Apple VZ and Firecracker microVMs for VM-grade isolation — warm pools adopt a pre-booted VM in ~7ms, and full-VM snapshots pause and resume running processes.
Keys can't be stolen
Your real provider key lives on the daemon and never enters a sandbox. Each sandbox is minted its own scoped token the moment it is wired for egress — the only key it ever sees — and the gateway swaps that token for the real key on the way out. Destroy the sandbox and its token is revoked in the same step — the only key it ever held dies with the cell, and a leaked token is worthless.
Money can't hemorrhage
Hard USD spend caps, model and provider allowlists, sliding-window rate limits, and token TTLs — plus a per-sandbox ceiling and real cost metering, LLM cost included.
Data can't leave
Lock egress down to just the gateway + an allowlist — kernel-enforced on microVMs (no NIC) and Linux containers, advisory on the microVM-NIC and macOS-Docker paths. On Linux a sandbox reaches only the gateway and a pinned DNS resolver, every denial logged; microVM guests get no network device by default, so the gateway, over vsock, is their only way out.
hotcell run --egress "printenv OPENROUTER_BASE_URL" # egress wired — code reaches the model via the gateway, no key insidespec sheet
Everything else a sandbox needs.
- persistent workspaces
- /workspace volumes survive stop, start, and daemon restarts.
- streamed exec + sessions
- SSE-streamed commands with persistent shell sessions.
- preview URLs
- An L4 proxy routes a URL to any port inside the sandbox.
- code interpreter
- Stateful Python and JS execution that holds state between calls.
- backups + restore
- Snapshot a sandbox, roll it back later.
- pause + resume
- Idle sandboxes hibernate; any operation resumes them. MicroVM snapshots resume in ~80ms.
- resource caps + admission
- Hard memory/CPU/PID caps; refuses to over-subscribe the host.
- metrics, cost, traces
- Per-sandbox CPU/mem/net, a configurable $ meter, OpenTelemetry.
procurement
Build, buy, or own.
Managed sandboxes bill per second forever. Building your own is 6–12 months of infra work. hotcell is the third option: own it without building it.
| Capability | hotcell | E2B self-host | Daytona | NVIDIA OpenShell | Tencent CubeSandbox |
|---|---|---|---|---|---|
| Install | npm i -g hotcell | Terraform + Packer deploy (Nomad/Consul); bring your own Postgres + Cloudflare domain | Managed cloud; BYOC deploys via Helm charts on Kubernetes | CLI + gateway (alpha, single-player) | Install script on Linux/KVM; single node or CubeMaster cluster |
| Keys out of sandbox | Yes — keys stay on the daemon; sandboxes get revocable tokens | Partial — header-injection proxy (beta); no key vault | — | Yes — placeholder tokens, fail-closed proxy | Yes — credential vault; keys injected at CubeEgress proxy |
| Spend caps + cost metering | Per-token and per-sandbox USD caps; real cost metering, LLM included | — | Compute metering (vCPU/RAM/disk); no LLM spend controls | — | — |
| Default-deny egress | Kernel-enforced on Linux and no-NIC microVMs; advisory on the microVM-NIC and macOS-Docker paths; every denial logged | No — internet on by default; opt-in filters cover ports 80/443 only | Restricted on lower tiers; registries and AI APIs always allowed | Yes — deny-by-default proxy, with a built-in inference.local bypass | Yes — L7 domain allowlists; eBPF prevents bypass; denials audited |
| True pause/resume | Yes — full-VM snapshots resume in ~80ms; idle auto-pause built in | Yes — orchestrator pause/resume | VM sandboxes only; containers lose memory on stop | — | Yes — AutoPause/Resume via full-VM snapshots |
| Fleet of sandboxes per host | One daemon runs the whole fleet, with admission control | Yes — orchestrator nodes run many sandboxes via cluster API | Daytona's control plane manages the fleet; BYOC = your runner nodes | Gateway API — alpha, one gateway per developer | Yes — Cubelet per node, CubeMaster cluster orchestration |
| Isolation tiers | Docker · Firecracker · Apple VZ microVMs | Firecracker microVMs (GCP; AWS beta) | Container class default; Linux/Windows VM classes (hypervisor unnamed) | Containers, libkrun microVMs, K8s pods | KVM microVMs (RustVMM) — Linux/KVM only |
| License | Apache-2.0 | Apache-2.0 | Private codebase since June 2026; AGPL-3.0 repo unmaintained | Apache-2.0 | Apache-2.0 (third-party component exceptions) |
Comparison reflects each project's own public docs as of July 2026 ("—" means the docs don't document it); corrections welcome via GitHub issue.
procedure
60 seconds to a contained agent.
- 1
npm i -g hotcell # CLI + daemon + TypeScript SDK, one install - 2
hotcell # guided from here: setup, provider keys, then your first sandbox
For scripts and CI, hotcell start runs the daemon in the background and returns your terminal — nothing prompts outside a TTY. Every command is also a REST call; the TypeScript SDK ships with the CLI, and pip install hotcell adds the Python SDK.
licensing
Open source and Cloud.
Open source — free forever
One daemon, one host, unlimited sandboxes. Every containment guarantee included. Apache-2.0.
hotcell Cloud early access
One control plane for your whole fleet: central key vault, org-wide egress policy, per-team spend quotas, SSO and audit. Your hardware, our coordination layer.
operator's manual
Questions, answered honestly.
How is this different from E2B?
E2B is a managed sandbox service billed per usage, with a self-host path that means standing up its full infra stack yourself. hotcell is one daemon you npm-install on hardware you already own — a Mac, a VM, or bare metal — with the containment layer (key vaulting, spend caps, tiered egress lockdown) built in rather than left to you. If you want someone else to run the servers, use a managed service; if you want the sandboxes on your own metal, that's what hotcell is for.
Does default-deny egress work on macOS?
Kernel-enforced default-deny egress is Linux-only for the container driver. On macOS with Docker Desktop, enforcement is advisory — the gateway, policy, caps, and cost metering all still work, but packets aren't dropped at a host firewall. For hardware-enforced lockdown on a Mac, use the Apple VZ microVM driver: microVM guests have no network device by default, so egress is denied by construction and the gateway, over vsock, is their only route out. A NAT NIC is opt-in for trusted workloads; on that path the allowlist is advisory (proxy-based), not enforced.
How strong is the isolation, really?
The container driver shares the host kernel — that's the tradeoff for speed and density. If you need hardware isolation, use the microVM tier: Apple VZ on macOS or Firecracker on Linux + KVM, both with full daemon-level parity on an 11-check end-to-end suite. Both have warm pools (a create adopts a pre-booted VM in ~7ms) and true pause/resume — a full-VM snapshot restores RAM and running processes, resuming in ~80ms on Firecracker vs ~2.5s cold boot. Egress enforcement comes in 3 tiers: kernel-enforced on a Linux container (host iptables); enforced by construction on a microVM with no NIC (the vsock gateway is the only way out); and advisory on a microVM with the opt-in NIC or on macOS Docker Desktop, where policy is applied at the proxy but raw sockets aren't dropped at a firewall.
Can I use my own LLM gateway or a custom provider?
Yes. The egress gateway speaks to OpenAI, Anthropic, OpenRouter, Google, or any custom endpoint you configure. Keys stay on the daemon either way — sandboxes only ever see their revocable per-sandbox tokens.
What happens to a sandbox's API key when I destroy it?
Nothing to rotate — it's already gone. You add your real provider key once, to the daemon; it never enters a sandbox. Each sandbox is instead minted its own scoped token (an "hc-…" string) when it's wired for egress, and that token is the only "API key" it ever holds — set as ANTHROPIC_API_KEY / OPENAI_API_KEY and pointed at the daemon's gateway. The gateway swaps the token for your real key on the way out, enforces that sandbox's spend cap, model allowlist, and rate limit, and meters every call. Destroy the sandbox and the daemon revokes its token in the same step, so a key's lifetime is exactly its sandbox's — a token that leaks from a dead cell buys an attacker nothing.
Is it really free? What will you charge for?
The daemon is Apache-2.0 and free: one host, unlimited sandboxes, every containment guarantee included, no feature gates. The paid product is hotcell Cloud — a coordination layer for fleets (central key vault, org-wide egress policy, per-team spend quotas, SSO, audit). It runs against your hardware either way.
Is it multi-tenant?
No — single-tenant by design. Anyone who can reach the API controls the sandboxes, so treat API access as shell access: bind the daemon to loopback or set an API key.