kosa8 runs each agent in its own microVM. Snapshot one mid-task and fork it N ways — processes, memory and filesystem intact — then let every branch explore a different solution in parallel.
$ kosa8 sandbox create build ✓ sandbox build up (576ms) $ kosa8 sandbox run build node:22 npm install … 1,412 packages installed # branch that exact state four ways $ kosa8 fork build -n 4 ✓ build-fork1 build-fork2 ✓ build-fork3 build-fork4 4 live VMs, node_modules already warm
Most agent sandboxes are disposable: you get isolation, and when the session ends the state is gone. kosa8 keeps it. A snapshot captures memory, running processes and a same-instant disk clone, so a restore resumes exactly where it paused — a running server keeps serving.
That makes branching the primitive. Drive an agent to the interesting point once, then fork and try four approaches from identical state instead of replaying setup four times.
Measured on one Apple-Silicon machine with make bench;
method and full results in the repo. Two other targets are currently missed —
see status.
A kit states which directory is visible, which hosts are reachable and which secrets exist. The sandbox enforces all three regardless of what the agent inside decides to do.
Each sandbox is its own kernel and its own container engine. A compromised agent gets a VM, not your laptop.
--egress deny, or name the only hosts a sandbox may reach. Enforced in the guest, not by asking nicely.
Every state-changing action recorded and HMAC-authenticated, exportable as JSONL or CEF for a SIEM.
ed25519-signed profiles pin allowed registries and egress defaults. A developer cannot weaken an installed policy.
Third-party MCP servers run inside their own sandbox and are aggregated behind one endpoint, tools namespaced.
42 of 48 docker commands work against the same socket, so existing tooling keeps working.
Docker Sandboxes covers microVM isolation for agents, and covers it on more platforms than we do. The thing it does not do is keep the state.
| Capability | Docker Sandboxes | kosa8 |
|---|---|---|
| microVM isolation per agent session | yes | yes |
| Network / filesystem policy | yes | yes |
| Centralized governance & audit | yes | signed policy + local audit |
| Snapshot live process state | — | yes |
| Fork a running sandbox N ways | — | yes |
| Migrate a snapshot between machines | ephemeral, no data at rest | push/pull via R2 |
| macOS, Windows and Linux hosts | yes | macOS / Apple Silicon |
| Signed, notarized installers | yes | not yet |
| Registry, hardened images, supply chain | yes | out of scope |
From docker.com and docs.docker.com, July 2026. We publish no comparative performance numbers because we have not measured Docker.
A developer running one agent and a developer running forty parallel branches get very different value from the same seat. So the meter is concurrent forks — it grows with how much of the solution space you explore at once, and never needs a seat renegotiation.
Beyond your plan: $0.90 per fork-hour · $12 per
extra concurrent slot / mo · $0.05 per GB / mo ·
$0 egress, because R2 charges us none.
Need a burst? +32 concurrent forks for 24 hours, $49.
Every plan is a monthly subscription with a 14-day full-feature trial.
There is no free tier. Running a regulated or air-gapped estate — SCIM,
your own R2 bucket, audit-key escrow, on-prem workers?
Talk to us.
kosa8 is in developer preview and billing is not open yet — the plans
above go live with the first signed release. Until then everything is
buildable from source.
kosa8 is a pre-1.0 developer preview. What that means concretely:
Build from source while signing is being set up — a downloaded daemon would be blocked by Gatekeeper.
$ git clone https://github.com/AzmxAI/kosa8 $ cd kosa8 && make build install-guest $ ./bin/kosa8 daemon start $ ./bin/kosa8 run alpine echo hi hi
Requires macOS on Apple Silicon and Go. Full setup, the sandbox guide and the remote-worker docs are in the repository.