// Software stack
Safe agent execution environment
Run agent-generated code in isolation, keep secrets out of the context window, and scan for leaks before committing.
5 pieces4 setup stepsscenario: Let agents run safely
What goes in it
- 1 ★ 14k
E2B Sandboxes & isolation Open source
Cloud code sandbox
Open-source, secure environment with real-world tools for enterprise-grade agents.
- 2 ★ 8.8k
microsandbox optional Sandboxes & isolation Open source
Self-hosted lightweight microVM sandbox
🧱 easy, fast, programmable and local-first microVM runtime and library
- 3 ★ 20k
gvisor optional Sandboxes & isolation Open source
Kernel-level container isolation
Application Kernel for Containers
- 4 ★ 30k
infisical Identity, secrets & agent security Open source
Secret management with on-demand injection
Infisical is the open-source platform for secrets, certificates, and privileged access management.
- 5 ★ 30k
gitleaks Identity, secrets & agent security Open source
Scans commits for leaked secrets
Find secrets with Gitleaks 🔑
How to set it up
- 01Run agent code in E2B (cloud) or microsandbox (self-hosted), never directly on the host
- 02Add gVisor to containers to restrict system calls
- 03Keep secrets in Infisical and inject them at runtime, never in prompts or the repo
- 04Scan with gitleaks before commits and again in CI
✓ Good fit
- Agents execute generated code or shell commands
✗ Look elsewhere if
- Agents only chat and never execute code