OpenAI Agents SDK sandboxes on kosa8

01What was tested

Tested with kosa8 v0.9.10, on 15 October 2026 on an Apple silicon Mac (macOS, arm64), with the released v0.9.10 binaries and guest image, with openai-agents 0.24.0, docker (the Python SDK) 7.2.0 and Python 3.12.13. No model was called; the sandbox client was driven directly.

• Worked: DockerSandboxClient.create(), session.start(), write() and read() of a file (sent over exec stdin), exec() running in the workspace (/workspace), persist_workspace() returning the workspace as a tar stream, and client.delete().

02Set it up

03Run a sandbox

import asyncio
import io
from pathlib import Path
 
import docker
from agents.sandbox.sandboxes.docker import DockerSandboxClient, DockerSandboxClientOptions
 
 
async def main():
    client = DockerSandboxClient(docker.from_env())  # reads DOCKER_HOST
    session = await client.create(options=DockerSandboxClientOptions(image="python:3.12-slim"))
    try:
        await session.start()
        await session.write(Path("hello.py"), io.BytesIO(b"print('hello from kosa8')\n"))
        result = await session.exec("pwd && python hello.py")
        print(result.exit_code, result.stdout.decode().strip())
        tar = await session.persist_workspace()  # the workspace as a tar stream
        print("workspace tar:", len(tar.read()), "bytes")
    finally:
        await client.delete(session)
 
 
asyncio.run(main())

python sandbox_on_kosa8.py
0 /workspace
hello from kosa8
workspace tar: 10240 bytes

docker.from_env() reads DOCKER_HOST, so the same code runs against Docker when the variable is unset.

04Limits

• Only the sandbox client was tested. A full agent run with a model was not part of this test.
• Host folders only from allowed directories. Bind mounts work only below a folder named with kosa8 daemon start --allow-mount DIR (add :rw for write access).
• Apple silicon runs arm64 images. Choose a sandbox image published for linux/arm64, such as the official python images.