Pre-release. v0.1.0-alpha.2 is an alpha release, not intended for production use.Project status
v0.1.0-alpha.2 · pre-release: release notes on GitHub

Open source · Apache-2.0 · Self-hosted orchestration

Everyone builds sandboxes.
We orchestrate them.

Differently is an open-source control plane for sandboxes. It runs on any cloud or on bare metal and places each sandbox on OpenSandbox, E2B, Daytona, a cloud provider's sandbox service or a plugin, according to placement policy. Applications use one API; quotas, placement decisions and audit live in the control plane.

$helm install differently deploy/helm/differently
A 36-second overview: private work stays on OpenSandbox, and overflows to an external provider only when policy allows it.

How it works

Policy-based placement

Requests are admitted against quota and queued. One elected scheduler checks every registered pool against global, organization and project policy, ranks the eligible pools and records the decision. Adapters then create the sandbox on a self-hosted OpenSandbox server or, where policy allows, on an external provider.

Applications call differently-server, which stores state in Postgres and places sandboxes on self-hosted OpenSandbox servers, or on external providers only when policy allows.SELF-HOSTED · OPERATOR-HELD KEYSApp · SDKCLI · dashboarddifferently-serverAPI · auth · quotasaudit · scheduler leaderPostgresOpenSandboxDocker · Kubernetes runtimeOpenSandboxFast Sandbox microVMsProvidersE2B · Daytona · cloudone APIonly if every policy allows
  1. Request. A client asks for a profile, capabilities and a placement policy.
  2. Filter and rank. Pools that fail a rule are excluded with a reason; the rest are ranked.
  3. Run and record. The sandbox is created; the decision, usage and audit events are stored.

Deployment

Deployment options

From a laptop to an air-gapped cluster. Verified options have run end to end; Documented options have written steps that have not been run end to end yet.

Laptop

Verified

Dev mode: an in-memory server with a devhost pool that runs commands directly on the host, with no isolation. For trying the API.

Laptop quickstart →

Any Docker host

Verified

Postgres, Differently and OpenSandbox as one Docker stack. Sandboxes are containers sharing the host kernel.

make e2e-prepare e2e-up

Docker stack on GitHub →

One Linux VM

Verified on Azure

AWS · Google Cloud · Azure · bare metal

k3s with OpenSandbox's charts and Differently's chart on a single machine.

Tested on Azure. The steps for AWS EC2, Google Compute Engine and bare metal are the same and have not been run yet.

Single-VM guide →

Existing Kubernetes

Documented

EKS · GKE · AKS · k3s · RKE2

Install the Helm chart on an existing cluster, next to an OpenSandbox server.

Kubernetes guide →

Air-gapped

Documented

Mirror the images and chart into a private registry. No telemetry, no phone-home.

Air-gapped guide →

Requirements

Control-plane requirements, the OpenSandbox server, network ports, and KVM hosts for Fast Sandbox microVMs.

Prerequisites →

Features

Built on OpenSandbox

Differently does not include a sandbox runtime. Its default private runtime is OpenSandbox, run by the operator. Differently adds multi-tenancy, quotas, placement policy and audit across every connected pool.

From OpenSandbox

Sandbox runtimes
Docker, Kubernetes, and Fast Sandbox (Firecracker microVMs on a per-node agent).
Lifecycle
Create and delete; pause and resume on Docker; stop and start on Kubernetes; a provider-side timeout as a TTL backstop.
Exec and files
Commands with env, cwd, timeouts and streamed output; upload, download and list files.
Snapshots
Disk snapshots and fork on Docker, Kubernetes and Fast Sandbox; memory-preserving pause on Docker and Fast Sandbox (a Fast Sandbox pause takes minutes).
Open source
Apache-2.0, self-hostable, with SDKs in several languages.

Added by Differently

Multi-tenancy
Organizations, projects and scoped API keys. OpenSandbox has one server-wide key.
Quotas and fair queueing
Usage derived from state, enforced at admission, queued fairly across tenants.
Policy-gated placement
Global, org and project policy plus data classification decide which pool may run each sandbox. External pools fail closed.
Many backends, one API
16 built-in provider adapters and plugins behind one contract and one SDK.
Placement explanations
Every decision records the pools considered, the ones rejected and why.
Audit and trust report
A tamper-evident audit chain and one report of endpoints, credentials by reference, external placements and limits.

Compared with a single provider

Single providerDifferently
Where sandboxes can runOne runtime or one vendorEvery registered pool, chosen per request
When a pool is full or downWait, fail, or change application codeQueue, or overflow to a pool policy allows
Switching providersChange SDKs and application codeChange placement policy; code stays the same
Who may use external capacityWhoever holds the keyOnly tenants, classifications and requests policy allows
Tenancy and quotasPer vendor account, or noneOrgs, projects, scoped keys and quotas across all pools
Knowing where work ranEach provider's own logsOne placement record, audit chain and trust report

Support per backend: the provider catalog, Features and feature parity.

SDKs and CLI

TypeScript, Python, Go and a CLI

Thin clients of one OpenAPI contract: exec, streamed output, files, snapshots, fork and ports, where the placed backend supports them.

import { Differently } from "@differently/sdk";

const differently = new Differently({ apiKey: process.env.DIFFERENTLY_API_KEY });

// Request a size and a placement policy, not a backend.
const sandbox = await differently.sandboxes.create({
  profile: "small",
  placement: { strategy: "private-first", external: "never" },
});

const result = await sandbox.exec("node --version");
console.log(result.exitCode, result.stdout);

await sandbox.files.write("/work/a.txt", "hi");
await sandbox.delete();

To run these locally, see Get started.

Capabilities

Control plane capabilities

01

Provider adapters

16 built-in adapters, from self-hosted OpenSandbox to E2B, Vercel and the AWS, Azure and Google Cloud sandbox services, plus a plugin protocol for any other backend. Operators change where work goes; applications keep the same API.

Provider catalog →
02

Quotas and policy-gated overflow

Registering a managed provider does not authorize its use. Work goes to an external pool only when global, organization and project policy, the data classification and the request all allow it. Quotas are derived from state and enforced at admission; ambiguous cases are denied.

Hybrid overflow guide →
03

Placement explanations

Each placement records the pools considered, the ones excluded and why, and how the rest were ranked. One API call returns the explanation for any sandbox.

Placement policy →
04

Trust report

One report of external endpoints, credentials by reference, external placements, admin actions, audit chain status, and the properties Differently cannot verify itself.

Security and trust model →

Project status · v0.1.0-alpha.2

Tested on real infrastructure

Verified

  • End-to-end suite. 14 of 14 tests pass on OpenSandbox's Docker runtime (arm64) and its Kubernetes runtime (single-node k3s on Azure, installed with Helm).
  • Kubernetes runtime. Stop/start with the disk kept, snapshots and fork through a snapshot registry, signed port URLs including WebSockets, and egress policy.
  • Idle auto-stop. Idle sandboxes stop (Kubernetes) or pause (Docker) and wake on the next call.
  • Release artifacts. The published chart and images install from public registries; the first sandbox runs in about 2 s.
  • Recorded runtimes. Real OpenSandbox responses from both runtimes are replayed in every go test.
  • OpenWork. Workbot computers run through Differently as a sandbox gateway, behind a flag: commands with Python tools, files, and stop/start.
  • Failure isolation. An image that cannot be pulled fails that sandbox only; the shared pool stays healthy.
  • agent-sandbox. The adapter runs against a Kubernetes cluster (kind, runc).
  • Daytona and Freestyle. The adapters run against live accounts: exec, files, port URLs, stop/start and snapshots on both, and egress policy, pause/resume, memory snapshots and fork on Freestyle.
  • Fast Sandbox. Firecracker microVMs on one node: Workbot's desktop streamed over a port URL, paused and resumed with its memory (a pause takes minutes), idled and woken by a request.

Not yet verified

  • The end-to-end suite on Fast Sandbox microVMs
  • Multi-node clusters and node drains
  • Managed EKS, GKE and AKS clusters
  • The other 12 provider adapters against live accounts; each is tested against a fake of its published API

Details: the support matrix, provider catalog, hardening checklist, proofs of concept and the feature parity table.

Get started

Run it locally

From a clone of the repository:

make build
./bin/differently-server --dev

# in a second terminal
./bin/differently sandbox create --profile small --wait

Dev mode has no isolation. State is kept in memory and the devhost pool runs commands directly on the host as the current user. Use it to try the API, not for untrusted code.

Run sandboxes differently.

Apache-2.0, developed in the open by the OpenWork team. Issues and pull requests are welcome.