Self-host Arrakis
release-36MicroVM sandboxes for AI agent code execution
curl -sSL https://raw.githubusercontent.com/abshkbh/arrakis/main/setup/setup.sh | bash- Stars
- 893
- Port
- 7000 (REST API of arrakis-restserver)
- Requires
- Cloud-hypervisor
What is Arrakis?
Arrakis is a self-hosted sandboxing platform for running AI-generated or otherwise untrusted code. Each sandbox is a MicroVM booted by cloud-hypervisor that runs Ubuntu with a code-execution service and a VNC desktop, so agent code stays isolated from the host and from other agents, while overlayfs guards the guest root filesystem. Clients — humans and AI agents alike — drive it through a REST API served by arrakis-restserver, a Go CLI, the py-arrakis Python SDK, or an MCP server, and Arrakis manages port-forwarding so sandbox GUIs, including the pre-installed Chrome used for computer-use workflows, are reachable without extra setup. Its signature capability is snapshot-and-restore: checkpoint a sandbox mid-task and later rewind to that exact state, which is useful for MCTS-style agents and for explaining elaborate agent runs. Guest images are customized by editing a Dockerfile, and a prebuilt Linux kernel ships out of the box, though you can pass your own. Installation is a curl-piped setup.sh that fetches prebuilt binaries on a Linux host with /dev/kvm; the REST server must be started with sudo (for iptables networking) and defaults to port 7000. It is licensed AGPL-3.0 with a commercial-licensing option, is Linux-only, and restoring a snapshot reuses the original VM's IP, so the old VM must first be stopped or destroyed.
Should you self-host Arrakis?
Arrakis scores 45/100 on selfhost.directory (how scoring works) and ranks #138 of 209 in AI Agents. It has 893 GitHub stars.
There was no stable release in the past 12 months, so check the repository's recent activity before you rely on it.
Setup is advanced: plan for several services and some ongoing maintenance. It is AGPL-3.0-licensed and written mostly in Go.
Its closest alternative on selfhost.directory is Orca (91/100, 108 446 stars). It scores higher overall, so compare the two before you pick. See Arrakis vs Orca side by side.
Features
- Automatic port forwarding
- CLI Client
- Code execution service
- MCP server support
- MicroVM isolation
- Python SDK
- REST API
- Sandbox networking and SSH
- Snapshot and restore
- Ubuntu guest image
- VNC desktop in sandbox
Arrakis README
More in Security
artifact-keeperSelf-hosted artifact registry with 45+ formats, security scanning, peer replication, Artifactory migration. MIT licensed, no feature gates or per-user fees.
auliteSelf-hosted HTTP proxy that checks AI interactions for EU AI Act compliance, records them in a tamper-proof audit log, and produces legal-grade PDF reports.
autheliaSelf-hosted, open-source IAM portal providing single sign-on, multi-factor authentication and an OpenID Certified OpenID Connect provider for proxied apps.
AuthorizerSelf-hosted open-source auth and authorization server: OAuth2/OIDC, social logins, magic links, MFA, passkeys, SAML SSO, RBAC plus embedded OpenFGA, on 13+ databases.
BastillionSelf-hosted bastion host with browser-based SSH terminal, centralized key management, and full session recording. Supports 2FA, SAML SSO, LDAP, runs as a single Java JAR.
beelzebubOpen-source, self-hosted deception runtime that turns SSH, HTTP, TCP, Telnet, MCP decoys into honeypots, configured via YAML rules, with LLM replies and Go plugins.
BeleniosBelenios is a self-hosted, open-source verifiable voting system implementing the Helios-C protocol with vote privacy and universal verifiability.
blindaiBlindAI is an open-source AI privacy solution using Intel SGX enclaves for confidential inference. Self-host models or query hosted ones via Python client.
blind_pin_serverSelf-hosted blind PIN oracle server that enforces 3 PIN attempt limits on Blockstream Jade hardware wallets, with optional Redis backend for PIN storage.
blindsendblindsend is a self-hosted, open-source file sharing tool with end-to-end encryption. Share or request files via secure links with optional passwords.
BunkerWeb🛡️ Open-source and cloud-native Web Application Firewall (WAF)
BytebaseSelf-hosted, open-source database governance: reviewed schema changes, SQL review rules, RBAC, masking, audit logs and an MCP server across 20+ engines.
0 comments