Plimsoll

Plimsoll is an open-source sandbox service designed to run untrusted code, such as that authored by AI agents, within isolated environments. It reports the actual isolation tier (process, container, kernel, VM) behind each run and enforces minimum isolation requirements before execution. The service supports multiple sandbox providers including WebAssembly (process tier), Docker containers, and Firecracker microVMs, allowing developers to balance between performance and security. Plimsoll also provides cryptographic verification and auditability of runs, supports capability-based access controls, and integrates with various AI agent frameworks for safe code execution.