n8n-sandbox-service: Isolated Execution with Sysbox and Firecracker

Overview

n8n-sandbox-service provides isolated, on-demand execution environments through a REST API. Sandboxes run as Docker/Sysbox containers or Firecracker microVMs, with a small HTTP daemon inside each environment for running commands and handling files.

Runners register with a central API, which places sandboxes and proxies requests to them. This suits teams building services that need temporary or isolated command execution without managing each environment directly.

Key Features

• Runs sandboxes in containers using Docker or Sysbox, or in Firecracker microVMs.
• Provides a REST API for interacting with sandboxes.
• Runs commands and handles files through an HTTP daemon inside each sandbox.
• Uses registered runners to place sandboxes and proxy requests.
• Includes a TypeScript SDK for API clients.
• Documents setup for Linux with Sysbox, KVM hosts with Firecracker, macOS development, and Kubernetes deployment.

Use Cases

• An application team needs isolated environments to execute user-submitted commands.
• A platform team wants a central API to place sandboxes across registered runners.
• A service needs file operations alongside command execution in an isolated environment.
• A team evaluating Kubernetes deployment wants a documented sandbox service and API rather than implementing runner coordination itself.

Getting Started

Choose a deployment path in the quickstart guides: Linux with Sysbox, Firecracker on KVM, macOS development, or Kubernetes. See the API guide and TypeScript SDK to call the service. The documentation index links to architecture, security, configuration, and operations details.

License in Plain Words

No standard license was detected. Without a license, the default copyright rules apply: you may read the code, but not reuse it. Check the repository or ask the authors.

Alternatives

• microsandbox: Microsandbox is a local Rust microVM runtime, while n8n-sandbox-service centrally places and routes requests to Docker, Sysbox, or Firecracker sandboxes.
• CubeSandbox: CubeSandbox targets AI-agent workloads with E2B SDK compatibility and microVM snapshots, while n8n-sandbox-service offers a REST API for centrally placed command environments.

Considerations

The project is relatively young, but its health data shows regular commits and releases, with recent activity from a broad contributor group rather than reliance on one person. Issue handling and pull-request merging have also been active. The latest listed release is a staging prerelease, so teams should check whether its release channel is suitable for their deployment. Running it requires choosing and operating an appropriate container or microVM runner; the repository documents different paths rather than removing that infrastructure burden. Review both license files, since .ee files and directories have separate terms.