Execute untrusted Python code in isolated Docker containers

TakoVM is a secure file system and Python execution environment for AI agents, with job queues and Docker isolation built in. Every job runs in its own isolated Docker container with an ephemeral workspace, optional gVisor sandboxing, job queues, retries, and execution history included. Unlike sandbox-only tools such as e2b, daytona, and microsandbox, which give isolated code execution but leave you to build a job queue, execution history, retry logic, idempotency, and replay tooling yourself, TakoVM bundles all of that: an async job queue and worker pool with no separate Redis/Celery setup, PostgreSQL-backed execution history (stdout, stderr, timing, artifacts) for every job, a rerun/fork API to replay past jobs with the exact same code and inputs, per-job Docker isolation with seccomp filtering, network isolation off by default with an optional per-job-type allowlist, and self-hosted, offline-capable, zero-per-execution-cost operation.

Isolation is layered: gVisor as a userspace kernel, per-job ephemeral Docker containers, a default-deny seccomp profile, --network=none by default, capability dropping, non-root execution, and enforced resource and input limits. The default security_mode: strict with container_runtime: runsc refuses to start a job rather than run it without the gVisor boundary; security_mode: permissive allows falling back to standard Docker (runc) on hosts without gVisor, at the cost of the userspace-kernel boundary, and is documented as unsuitable for untrusted code.

Use it when agents need to execute untrusted, often AI-generated code and you want the full operational stack - job queue, execution history, retries, replay/debugging, and isolation - rather than assembling it yourself on top of a bare sandbox. It is self-hosted and offline-capable, which fits teams that want zero per-execution cost and control over the isolation boundary.

Today each container is single-use; persistent, per-agent workspaces that rehydrate across runs are on the roadmap, not yet shipped. Do not run untrusted code under security_mode: permissive - that mode's runc fallback removes the gVisor userspace-kernel boundary and is intended for hosts without gVisor (local development or CI), not production isolation.

Input is code submitted via the REST API or the Python SDK, for example curl -X POST http://localhost:8000/execute -d '{"code": "print(1 + 1)"}'. Output is the job's execution history - stdout, stderr, timing, and artifacts - persisted in PostgreSQL and retrievable for replay or forking with the same code and inputs via the rerun/fork API.

pip install "tako-vm[server]"
tako-vm setup                   # pull the executor Docker image
tako-vm server                  # start server (auto-starts PostgreSQL via Docker)

Requires Docker and Python 3.10+; the server auto-starts PostgreSQL via Docker. The CLI also covers tako-vm dev up (local PostgreSQL for development), tako-vm config, tako-vm validate, and tako-vm status. Apache License 2.0.

Teams deploying AI agents in production, including enterprise deployments, that need agents to execute code safely, with the surrounding job-queue, history, and replay infrastructure included rather than built from scratch.