Use case · Platform and developer-experience teams
Give every team a microVM sandbox behind the Docker API they already use.
Updated 2026-10-31
kosa8 is a microVM sandbox platform for platform and developer-experience teams: it serves a Docker-compatible API on a local socket, a native API with a typed TypeScript SDK, and an MCP server, so existing tools and agents can drive it. A signed org policy sets the same rules on every machine: which registries, which MCP servers, what network by default, and whether containers must run in a sandbox VM.
01The problem: every team, a different sandbox story
Coding agents, code interpreters and MCP tool servers arrive faster than a platform team can review them. Each brings its own idea of isolation, or none, and containers on Linux share the host kernel. Security wants one set of rules across laptops and shared workers, and evidence that the rules held.
The constraint is adoption: a sandbox nobody's tooling can talk to does not get used. kosa8 meets tools where they are, through the Docker API, an SDK or MCP.
02A Docker-compatible API
Point a Docker client at kosa8's socket. It reports Docker Engine 28.3.0, API 1.51. Testcontainers, dockerode, the smolagents Docker executor and the OpenAI Agents SDK Docker sandbox are tested; Testcontainers needs Ryuk off, because kosa8 never shares its socket into a container, and removing images through the Docker API is not served yet (use kosa8 rmi).
03A TypeScript SDK, a native API and MCP
@kosa8/sdk is a typed client for Node 18 and later covering sandboxes, run and exec, egress and the broker, checkpoint and rewind, fork, snapshots and signed approvals. @kosa8/ai-sdk-sandbox gives the Vercel AI SDK 7 a kosa8 sandbox. Anything else can call the JSON API under /kosa8/v1, or connect an agent to the MCP server.
04One signed policy for the fleet
Write a profile once (allowed registries, allowed MCP servers, default egress, require a sandbox VM), sign it with your org key and install it on each machine with the public key pinned. An edited policy fails verification and stops operations rather than being ignored. A separate signed MCP policy decides which tools each team may call.
05Laptops and shared workers, same commands
A Mac or Linux machine can serve as a worker for other devices. Clients point KOSA8_HOST at it, and kosa8 run, kosa8 sandbox and kosa8 fork work unchanged. Serving over TCP requires a token.
06Gate rollouts on a baseline, forward the audit
kosa8 doctor --compliance exits non-zero when a required control fails, so it can gate a deployment in CI. The daemon forwards audit entries to syslog over mutual TLS, Splunk HEC or HTTPS, and per-agent tokens put each agent's name in the entries it causes.
07How to start
Start with one tool your teams already run through Docker, and point it at kosa8.
Install kosa8 on an Apple silicon Mac or x86-64 Linux, then start the daemon.
Set DOCKER_HOST for that tool's environment and run its usual test; then check the engine and the log.
08Questions
Can our existing Docker tooling use kosa8?
Tools that speak the Docker Engine API can, by pointing DOCKER_HOST at unix://$HOME/.kosa8/run/kosa8.sock. Testcontainers, dockerode, the smolagents Docker executor and the OpenAI Agents SDK Docker sandbox have been tested. Removing images through the Docker API is not served yet, so use kosa8 rmi for that.
Can a developer loosen the org policy on their own laptop?
No. The policy is signed with your organisation's ed25519 key and checked against the pinned public key. An edited policy fails verification, and a policy that fails verification stops operations rather than being ignored.
Does kosa8 need a central server?
No. kosa8 is a binary and a daemon on each machine, with no account or control plane. Policy is distributed as a signed file, and a client can drive a shared Mac or Linux worker over HTTPS with KOSA8_HOST and a token.
Which SDKs are there?
@kosa8/sdk is a typed client for the native API for Node 18 and later, and @kosa8/ai-sdk-sandbox gives the Vercel AI SDK 7 a kosa8 sandbox. Other languages can use the HTTP API, the Docker-compatible API or the MCP server.
09Further reading
- Integrations: tools tested on kosa8's Docker-compatible API
- How do I run the OpenAI Agents SDK with a local sandbox?
- How do I self-host a code interpreter for AI agents?
- How do I run MCP servers in a sandbox?
- How do I try several AI agent approaches in parallel?
- AI agent sandboxes in 2026: a map of the options
- Devcontainers for AI coding agents
10Sources
11Get kosa8
Install kosa8 on one machine and point one Docker-based tool at it. Fleet and Enterprise terms are on the pricing page.