Sandlock
Sandlock: A deep, open-source Linux sandbox for teams that need granular policy controls. Ranked #5 of 25 in Sandbox Software by our editors (7.3/10); pricing: Free plan; best for linux teams needing granular policy controls.
At a glance
- Editor score7.3 / 10
- PricingFree plan
- Best forLinux teams needing granular policy controls
- Free planYes
- Facts checked21 Sep 2026
Where it wins
- Filesystem, network, syscall, and resource controls
- Open source with CLI, Python, Rust, and Go SDKs
- OCI runtime supports containerd, CRI-O, and Kubernetes
Where it doesn't
- Core platform coverage is Linux-only
- HTTP API and Scheduler pricing depends on fleet size or node count
- Fleet deployment features are split across commercial components
Our verdict on Sandlock
Sandlock is a Linux process sandbox for running untrusted code, aimed at teams that need policy-level control over filesystems, network access, system calls, and resource usage. Its core product is Apache-2.0 licensed and available through a free plan. Sandlock does not require root, a container runtime, or a hypervisor, and includes a CLI, Python, Rust, and Go SDKs, an OCI runtime, and an MCP server. The product is focused on Linux environments, with API access also represented in its platform coverage.
The published plans separate the core Sandlock product from fleet-oriented components. The Sandlock plan includes the Apache-2.0-licensed core, CLI, SDKs, OCI runtime, and MCP server. The Sandbox HTTP API adds an API server, client SDKs, and unlimited sandboxes and keys per deployment. Sandbox Scheduler adds placement, a checkpoint store, and routers. The HTTP API and Scheduler are commercial components, with pricing based on fleet size or node count, making the plan structure most relevant to teams planning self-hosted fleet deployments rather than a single local sandbox.
Policy depth is Sandlock’s defining strength. Filesystem rules cover read, write, deny, chroot, and per-sandbox mounts, while copy-on-write workspaces support commit, abort, keep, and dry-run modes. Network policies can allow or deny hosts, IPs, CIDRs, protocols, and ports; HTTP controls cover methods, hosts, and paths, with HTTPS interception. Resource limits include memory, processes, open files, CPU, disk, and GPU. Custom syscall handlers can audit, deny, or fabricate results. Choose Sandlock when Linux compatibility and granular enforcement matter most; teams needing broader platform coverage should consider a different sandboxing approach.
Sandlock pricing
All 3 Sandlock plans and prices →
Sandlock fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Not verified |
| Isolation method | Not verified |
| Concurrent environments | Not verified |
| Persistent storage | Yes |
| Network controls | Yes |
| API or CLI access | Yes |
| Deployment | Self_hosted |
| Deployment | Self-hosted |
| Platforms | Linux |
| Support | Email, Community, Docs |
| Built for | Small business, Mid-market, Enterprise (editorial estimate) |
| Pricing | Free plan (source) |
| Website | sandlock.io |
| Facts checked | 21 Sep 2026 |
Alternatives to Sandlock
- E2BProduction-grade isolation, flexible controls, and SDK access for AI code execution.9.8
- microsandboxFlexible sandbox infrastructure for teams running high-volume isolated workloads.9.0
- Docker SandboxesA focused sandbox for running coding agents with isolation, policies, and persistent state.8.3
See all Sandlock alternatives →
Sandlock vs the competition
- Sandlock vs E2B
- Sandlock vs microsandbox
- Sandlock vs Docker Sandboxes
- Sandlock vs Daytona
- Sandlock vs Anthropic Sandbox Runtime
- Sandlock vs Context Agent Sandboxes
Compare Sandlock with any tool side by side →
Used Sandlock? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Sandlock for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Sandlock is listed in our Sandbox Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/sandlock/"><img src="https://www.itechguides.com/best/badge/sandlock.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Guides on sandbox software
- Windows Sandbox Alternatives for Windows 11 HomeAug 2026
- Best Sandbox Applications for Windows 10: 5 Options Compared (2026)Aug 2026
- 4 Best Methods to Enable Windows Sandbox and Configure Policies in Windows 11Aug 2026
Reviewed by iTechGuides Editors · Editorial team · Updated Sep 2026
Advertiser disclosure: iTechGuides is reader-supported. We may earn a commission when you click some links. How we rank.
Last updated · How we research and update