Reference
If you know docker run, you know most of this already. The interesting ones are at the bottom: checkpoint, rewind, fork, explore, model, policy.
kosa8: run anything, fork everything, trust the sandbox. Available Commands: create Boot a new sandbox microVM exec Run a command in a container inside a sandbox ls List sandboxes pull Pull an image into a sandbox's private engine rm Stop and delete a sandbox run Run a container inside a sandbox's private engine
The list
Generated from the binary, so it cannot drift from what is actually installed.
kosa8 sandbox
Manage isolated microVM sandboxes
kosa8 checkpoint
Save a restore point you can rewind to
kosa8 rewind
Put a sandbox back to a saved restore point
kosa8 fork
Fork a running sandbox into N live copies with process state intact
kosa8 explore
Fork a sandbox per approach, run each, and report which worked
kosa8 model
Pull and serve local models (OpenAI- and Anthropic-compatible)
kosa8 desk
Open the local dashboard in a browser
kosa8 policy
Org policy profiles: signed, verified, enforced client-side
kosa8 mcp-policy
Govern which MCP servers and tools each team may use
kosa8 approve
See what an action would do, and decide what may run unprompted
kosa8 audit
Inspect what was done, by whom
kosa8 ai
Chat with kosa8's embedded assistant (approval-first, live state)
kosa8 agent
Run coding agents in isolated sandboxes
kosa8 mcp
Run kosa8 as an MCP server so AI agents can drive it
kosa8 remote
Manage remote (Cloudflare R2) snapshot storage
kosa8 doctor
Check that this machine can run kosa8, and repair what is safe to repair
kosa8 run
Run a container in the kosa8 engine VM (auto-pulls on first use)
kosa8 exec
Run a command in a running container
kosa8 ps
List containers
kosa8 start
Start a created container
kosa8 stop
Stop a running container (SIGTERM, then SIGKILL)
kosa8 restart
Restart a container
kosa8 kill
Kill a running container
kosa8 pause
Pause all processes in a container
kosa8 unpause
Resume a paused container
kosa8 attach
Attach to a running container's output
kosa8 logs
Fetch the logs of a container
kosa8 create
Create a container without starting it
kosa8 rm
Remove a container
kosa8 rename
Rename a container
kosa8 wait
Block until a container stops, then print its exit code
kosa8 top
List processes running inside a container
kosa8 stats
Show resource usage of a running container
kosa8 port
Show published ports for a container
kosa8 inspect
Show detailed container state
kosa8 diff
Show filesystem changes made to a container
kosa8 images
List images in the engine
kosa8 pull
Pull an image into the kosa8 engine
kosa8 push
Push an image to a registry
kosa8 build
Build an image from a Dockerfile
kosa8 builder
Manage the BuildKit builder
kosa8 commit
Create an image from a container's filesystem
kosa8 tag
Give an existing image another name
kosa8 rmi
Remove an image from the engine
kosa8 save
Save an image to an OCI archive
kosa8 load
Load an image from an OCI archive
kosa8 import
Create an image from a rootfs tar archive
kosa8 export
Export a container's filesystem as a tar archive
kosa8 history
Show the layer history of an image
kosa8 manifest
Inspect image manifests in a registry
kosa8 search
Search Docker Hub for images
kosa8 daemon
Manage the kosa8d daemon
kosa8 info
Show engine and system information
kosa8 version
Show kosa8 client and daemon version
kosa8 events
Stream engine events
kosa8 system
Manage kosa8 itself
kosa8 network
Manage container networks
kosa8 volume
Manage named volumes
kosa8 cp
Copy files between the host and a container (CONTAINER:PATH)
kosa8 login
Log in to a registry
kosa8 logout
Remove stored registry credentials
kosa8 license
Activate and inspect your kosa8 subscription
kosa8 usage
Show metered usage, derived from the audit log
kosa8 update
Update a running container's resource limits
kosa8 snapshot
Snapshot and restore sandbox state
kosa8 up
Detect, build and run a project — no Dockerfile required
And the interesting ones have a guide with worked examples.