How do I sandbox CrewAI code after CodeInterpreterTool?

01Steps

1. Install kosa8. On an Apple silicon Mac or x86-64 Linux:

   curl -fsSL https://kosa8.com/install.sh | shCOPY

2. Create a sandbox with no network. This is a microVM with its own kernel. --egress deny is enforced on the host, so nothing leaves it, DNS included. Use --egress-allow pypi.org --egress-allow files.pythonhosted.org instead if the code must install packages.

   kosa8 sandbox create code-runner --egress deny --cpus 2 --memory 2048COPY

3. Pull an image and take a clean checkpoint. The checkpoint captures the sandbox's memory, processes and disk, so every task can start from this state.

   terminal

   kosa8 sandbox pull code-runner python:3.12-slim
   kosa8 checkpoint code-runner --label clean

4. Write the tool. A BaseTool subclass with an input schema. The model sees the name and description; the code runs only inside the sandbox.

   sandbox_tool.py

   import subprocess
    
   SANDBOX = "code-runner"          # created with: kosa8 sandbox create code-runner --egress deny
   IMAGE = "python:3.12-slim"
    
   def run_in_kosa8(code: str, timeout: int = 120) -> str:
       """Run Python in a container inside the kosa8 microVM and return its output."""
       try:
           p = subprocess.run(
               ["kosa8", "sandbox", "run", SANDBOX, IMAGE, "python", "-c", code],
               capture_output=True, text=True, timeout=timeout,
           )
       except subprocess.TimeoutExpired:
           return f"error: no result after {timeout}s"
       return f"exit code {p.returncode}\nstdout:\n{p.stdout}\nstderr:\n{p.stderr}"
    
   from typing import Type
   from crewai.tools import BaseTool
   from pydantic import BaseModel, Field
    
   class CodeInput(BaseModel):
       code: str = Field(..., description="Python code to run. Print the results.")
    
   class SandboxPythonTool(BaseTool):
       name: str = "run_python_in_sandbox"
       description: str = "Run Python in an isolated machine with no network and return its output."
       args_schema: Type[BaseModel] = CodeInput
    
       def _run(self, code: str) -> str:
           return run_in_kosa8(code)

5. Give it to the agent. Leave allow_code_execution unset and pass the tool like any other.

   crew.py

   from crewai import Agent
    
   analyst = Agent(
       role="Data analyst",
       goal="Answer questions by writing and running Python",
       backstory="Runs every calculation in the sandbox.",
       tools=[SandboxPythonTool()],
   )

6. Rewind between tasks, and check the record. Rewind returns the whole machine to the clean checkpoint, which also clears anything a timed-out run left behind. The audit log records every action, and kosa8 audit verify checks its hash chain.

   terminal

   kosa8 rewind code-runner --to clean --yes
   kosa8 audit ls
   kosa8 audit verify

02What happened to CrewAI's CodeInterpreterTool and allow_code_execution?

CrewAI's CodeInterpreterTool page now says the tool has been removed from crewai-tools and that the allow_code_execution and code_execution_mode parameters on Agent are deprecated. It recommends a dedicated sandbox service and names E2B and Modal.

Some examples on the same page still show allow_code_execution=True, so expect older tutorials to use it.

03What did CrewAI's unsafe_mode do?

It ran the agent's Python directly on the host. CrewAI's docs mark it NOT RECOMMENDED FOR PRODUCTION and say it allows any Python code, including calls to sys and os. The tool's default was a Docker container, with a restricted fallback when Docker was unavailable.

04Why run CrewAI code in a microVM rather than on the host?

Code an agent writes can be wrong or steered by a prompt injection, and on the host it can reach your files, credentials and network. In a kosa8 sandbox it has its own kernel, no host folders unless you mount them, a network policy enforced outside the VM, and a checkpoint you can rewind to.

Need a package index? Create the sandbox with --egress-allow for those hosts only. To share a folder, kosa8 sandbox create takes --mount HOST:GUEST[:ro].

05Other options

• E2B or Modal. The hosted sandbox services CrewAI's docs name, a fit when you want execution in the cloud and no local setup.
• Daytona. Another hosted sandbox you can call from a custom tool.
• A Docker container. The same custom-tool pattern with docker run --network none; containers share the host kernel on Linux.
• gVisor or Kata Containers. Stronger container runtimes for Linux hosts.
• A full VM in UTM or Lima. Run the whole crew inside a VM when the agents themselves, not only their code, should be contained.

06Sources

• CrewAI docs: Code Interpreter (removal and deprecation notice)
• CrewAI docs: Create custom tools
• kosa8 docs: Your first sandbox
• kosa8 docs: Network rules
• kosa8 docs: Undo (checkpoint and rewind)
• kosa8 docs: The audit log

07Related guides

• How do I sandbox LangChain and LangGraph code execution?
• How do I make smolagents code execution secure locally?
• How do I build a self-hosted code interpreter for my LLM?
• How do I run untrusted LLM-generated code safely?
• How do I restrict an AI agent's network access to an allow-list?
• How do I undo what an AI coding agent did?