LLM-in-Sandbox CLI
A CLI connects a model to a Docker-container terminal so an agent can run commands, create files and save its step history
- 247 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- The model selects container Bash commands, receives copies of input files and has network access
- The API key goes through the --api_key flag or an environment variable, and queries and file contents are sent to the chosen model provider
- It needs access to the Docker daemon, which usually requires elevated rights on the machine
Install
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/llm-in-sandboxDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The model selects container Bash commands, receives copies of input files and has network access
- The API key goes through the --api_key flag or an environment variable, and queries and file contents are sent to the chosen model provider
- It needs access to the Docker daemon, which usually requires elevated rights on the machine
This is third-party code. Review the repository files before installing.
What it does
LLM-in-Sandbox runs an agent loop in which a model selects commands and a Docker container executes them. `llm-in-sandbox run` takes a task, model name and API endpoint. The agent can read supplied files, write and execute code, and save results. The `cdx123/llm-in-sandbox:v0.1` image downloads on first use. The project grew out of RUC AI Box research on tasks beyond programming, from long-document processing to file preparation and scientific calculations. Filesystem access lets the agent consult relevant portions as needed. Benchmark results in the paper belong to the authors’ configurations. Model access uses LiteLLM, supporting compatible providers and self-hosted vLLM or SGLang with appropriate tool calling. Each run creates a timestamped directory. `files` contains `answer.txt` and generated files, while `trajectory.json` records actions and observations.
Who it is for. For researchers and developers who test models as general-purpose agents and want command execution isolated in a container.
Good fit when
- You want to check how much better a model with terminal access handles a chemistry, physics or math task
- A long document does not fit the context and the agent has to read it piecewise from sandbox files
- You need to reproduce the results of the Computer Environments Elicit General Agentic Intelligence in LLMs paper through the benchmark module
- You serve a model on vLLM or SGLang and want to see how it behaves as an agent with a command line
- You want to run a small task such as a poster or a music piece and collect the finished files from the output folder
Not a fit when
- You want an assistant to edit your repository inside Cursor or Claude Code: the project runs its own agent and does not plug into an editor
- You cannot install Docker on the machine: the sandbox does not work without it
- You need isolation guarantees for untrusted code: the project relies on Docker isolation and describes no separate security testing
- You need Windows: the project was tested on Ubuntu 22.04 with Python 3.10
Example request
Run llm-in-sandbox with the query "plan a three-day trip to Kazan" and show which files land in the output folderLimitations
Python 3.10 or later, Docker and access to its daemon are required. The author reports testing on Ubuntu 22.04 with Python 3.10; this does not establish other-platform compatibility. External APIs need no local GPU, while self-hosted models require suitable servers and hardware.
Commands run in the container without a separate approval for every step. Network access is not disabled by default, and explicit memory limits are absent. Docker does not establish complete isolation of untrusted code. `--input_dir` copies input files into the container, and command results may be sent to the model.
`--max_steps` defaults to 100. It caps steps without guaranteeing cost or success. Output files, history and the downloaded image remain after the container is removed. The license is Apache-2.0.
How to disable. Run `pip uninstall llm-in-sandbox`. `docker rmi cdx123/llm-in-sandbox:v0.1` removes the container image, and result folders live in `./output` unless you set another path with `--output_dir`.
FAQ
How do I install LLM-in-Sandbox?
Install Docker, then run `pip install llm-in-sandbox==0.2.0`. You can also install from source by cloning the repository and running `pip install -e .`. The container image downloads on the first run.
Which models connect to LLM-in-Sandbox?
The CLI uses LiteLLM: choose a supported provider or compatible vLLM/SGLang server and a model with tool calling. Set the model name and endpoint separately. Key requirements depend on the API; self-hosted servers may also require authentication.
Where does LLM-in-Sandbox save the agent's result?
In a timestamped folder under `./output`; `--output_dir` changes the path. Inside are a `files` subfolder with the answer in `answer.txt` and created files, and `trajectory.json` with the step history.
Can I give the agent my own files?
Yes. `--input_dir` selects a directory whose contents are copied into the container, rather than bind-mounted from the host. Supply only required files: the agent can read the copy, and read results may reach the model provider.
How is LLM-in-Sandbox different from an ordinary coding agent?
It is a research environment for tasks where a model benefits from files and command execution. It includes examples and tools for reproducing the authors’ benchmarks. Results depend on the model, task and container configuration.
Discussion
No questions or reviews yet.
Related
CLI toolsA CLI and Python library for OpenAI, Claude, Gemini, local and other models: prompts, chats, tools, embeddings and a SQLite log
llmman runs Claude Code, Codex and OpenCode on a local or hosted model with one command and stores models as OCI images
A Docker container bundling browser, terminal, files, VS Code and MCP services for running agent actions safely in isolation
mi is agentic coding in 30 lines: a loop, two tools and a model; works with any OpenAI-compatible API and runs in Docker.
A vLLM-style inference server on MLX that runs language models on Apple Silicon Macs and serves them over an API
LM Studio commands list downloaded and loaded models, control the local API server and stream application logs in a terminal.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| LLM-in-Sandbox (this card) | no | 247 | ||
| Zerobox | no | 729 | a sandbox for an agent's own commands and code, with no agent of its own and no benchmarks | |
| CodeRunner | yes | not required | 900 | a local sandbox for running code on an agent's request, with no model built in |
| coop | no | 807 | A CLI that creates separate virtual machines for coding agents, keeping their development tools away from the main host system. |
README in short
Run history is stored separately from final files. With `save_litellm_response` enabled, output also includes full model requests and responses; inspect that directory before publishing or sharing it.