latest release · v0.17.0
Paste one line. That's it.
The installer works out which computer you have, checks the download really came from us, and puts kosa8 where your terminal can find it.
macOS & Linuxemail only, no cardcheck it yourself
Every way in
Pick your platform.
One line recommended
Works out whether you have an Apple or Intel chip, checks the download against the published fingerprints, and puts it on your PATH.
The Mac app easiest
An application with an icon, a window and a menu bar. It carries the command-line tool inside it, so this is the only thing you need. Signed, notarised and stapled, so it opens offline without a prompt.
Homebrew
Upgrade later with brew upgrade kosa8. Answer the one-time prompt about trusting a third-party tap.
Direct download
Signed and notarised, so it opens without a security warning. Verify the checksum.
Apple chip Macs run everything. Intel Macs get the command-line tool only — the part that runs sandboxes needs a hypervisor feature Apple ships on its own chips, so an Intel Mac connects to one that has it.
PowerShell recommended
Installs to your user profile, so no administrator rights are needed, and adds itself to PATH.
Installer desktop app
A per-user installer with a Start-menu entry for the desktop app, a window around the dashboard.
Scoop
The manifest is regenerated on every release, so scoop update tracks new versions.
Direct download
A single kosa8.exe, Authenticode-signed so Windows will not warn about an unknown publisher.
Run sandboxes on this PC preview
Windows 11 on an x86-64 PC runs sandboxes itself, in WSL2: run this once after installing. It checks WSL2 and nested virtualization, installs kosa8's Linux engine into an Ubuntu distribution, starts it and connects this CLI to it. Every command then works as on a Mac.
Windows 10 and Windows on ARM can't run the containers itself. There it is a remote client: it connects to an Apple chip Mac or a Linux machine that does the work. Run kosa8 worker pair --url … on that machine and kosa8 worker join CODE here.
One line recommended
Detects your architecture, verifies the download, installs to /usr/local/bin.
Debian · Ubuntu
Also built for arm64. Uninstalls cleanly with apt remove kosa8.
Fedora · RHEL
Also built for arm64.
Desktop app
A native window around the dashboard. Install the kosa8 package first; the desktop package depends on it.
Direct download
x86-64 Linux runs sandboxes itself, on KVM with Cloud Hypervisor: it needs /dev/kvm, cloud-hypervisor and virtiofsd, and kosa8 doctor checks them all. On arm64 the local engine is opt-in (KOSA8_LINUX_ENGINE=1); otherwise it connects to one with KOSA8_HOST and KOSA8_TOKEN.
JioBook · Android arm64
Unpack it and put kosa8 on your PATH.
Pair it with a worker
On the Mac or Linux machine: kosa8 daemon start --listen 127.0.0.1:7440, then kosa8 worker pair --url https://… prints the code. Every command on the JioBook then runs there.
JioOS is a remote client: it can't run the containers itself — Android gives apps no hypervisor to drive — and connects to a Mac or Linux machine that can.
Check it yourself
Don't take our word for it.
Compare the checksum
Every release ships checksums.txt, generated from the files that were actually published rather than from the ones that were built.
Check the macOS signature
It should show a Developer ID signature and report the notarisation, not adhoc. The daemon carries the virtualization entitlement, which macOS honours only under a signature it trusts.
Check the Windows signature
Status should be Valid. An unsigned build fails the release pipeline before it can be published, so one reaching you unsigned would be a bug worth reporting.
Before you install
Three things worth knowing.
Sandboxes need a hypervisor
The sandboxes are real virtual machines. An Apple chip Mac runs them on Apple's Virtualization.framework, x86-64 Linux on KVM, and Windows 11 on x86-64 in WSL2 (preview). Intel Macs, Windows 10, Windows on ARM and JioOS get a remote client that connects to one — useful on a team, not a local runtime.
Shared folders are slow
A folder shared from the host runs at about 29% of native speed against a 70% target we set and missed. Most of it is the unavoidable cost of the isolation. Every number, including that one.
There is no free tier
Every plan starts with a 14-day trial and no card. After that it is paid — there is no permanently free plan, and we would rather you read that here than discover it on day fifteen. What it costs.
After it lands
Ninety seconds to your first sandbox.
Check the machine
Each check comes with the reason it matters and the command that fixes it.
Make a sealed machine
Its own kernel, its own network. Ready in about half a second.
Look at it
The dashboard, on loopback, with a token that dies with the process.
curl -fsSL https://kosa8.com/install.sh | sh detecting platform … darwin/arm64 verifying checksum against published fingerprints installed kosa8 0.17.0 to /usr/local/bin/kosa8 next: `kosa8 doctor`, then `kosa8 sandbox create first`
From here to a sandbox you can undo.
One line, no account, no card.