Laptop
VerifiedDev mode: an in-memory server with a devhost pool that runs commands directly on the host, with no isolation. For trying the API.
Laptop quickstart →Open source · Apache-2.0 · Self-hosted orchestration
Differently is an open-source control plane for sandboxes. It runs on any cloud or on bare metal and places each sandbox on OpenSandbox, E2B, Daytona, a cloud provider's sandbox service or a plugin, according to placement policy. Applications use one API; quotas, placement decisions and audit live in the control plane.
helm install differently deploy/helm/differentlyHow it works
Requests are admitted against quota and queued. One elected scheduler checks every registered pool against global, organization and project policy, ranks the eligible pools and records the decision. Adapters then create the sandbox on a self-hosted OpenSandbox server or, where policy allows, on an external provider.
Deployment
From a laptop to an air-gapped cluster. Verified options have run end to end; Documented options have written steps that have not been run end to end yet.
Dev mode: an in-memory server with a devhost pool that runs commands directly on the host, with no isolation. For trying the API.
Laptop quickstart →Postgres, Differently and OpenSandbox as one Docker stack. Sandboxes are containers sharing the host kernel.
make e2e-prepare e2e-up
AWS · Google Cloud · Azure · bare metal
k3s with OpenSandbox's charts and Differently's chart on a single machine.
Tested on Azure. The steps for AWS EC2, Google Compute Engine and bare metal are the same and have not been run yet.
Single-VM guide →EKS · GKE · AKS · k3s · RKE2
Install the Helm chart on an existing cluster, next to an OpenSandbox server.
Kubernetes guide →Mirror the images and chart into a private registry. No telemetry, no phone-home.
Air-gapped guide →Control-plane requirements, the OpenSandbox server, network ports, and KVM hosts for Fast Sandbox microVMs.
Prerequisites →Features
Differently does not include a sandbox runtime. Its default private runtime is OpenSandbox, run by the operator. Differently adds multi-tenancy, quotas, placement policy and audit across every connected pool.
| Single provider | Differently | |
|---|---|---|
| Where sandboxes can run | One runtime or one vendor | Every registered pool, chosen per request |
| When a pool is full or down | Wait, fail, or change application code | Queue, or overflow to a pool policy allows |
| Switching providers | Change SDKs and application code | Change placement policy; code stays the same |
| Who may use external capacity | Whoever holds the key | Only tenants, classifications and requests policy allows |
| Tenancy and quotas | Per vendor account, or none | Orgs, projects, scoped keys and quotas across all pools |
| Knowing where work ran | Each provider's own logs | One placement record, audit chain and trust report |
Support per backend: the provider catalog, Features and feature parity.
SDKs and CLI
Thin clients of one OpenAPI contract: exec, streamed output, files, snapshots, fork and ports, where the placed backend supports them.
import { Differently } from "@differently/sdk";
const differently = new Differently({ apiKey: process.env.DIFFERENTLY_API_KEY });
// Request a size and a placement policy, not a backend.
const sandbox = await differently.sandboxes.create({
profile: "small",
placement: { strategy: "private-first", external: "never" },
});
const result = await sandbox.exec("node --version");
console.log(result.exitCode, result.stdout);
await sandbox.files.write("/work/a.txt", "hi");
await sandbox.delete();from differently import Differently
client = Differently() # DIFFERENTLY_API_KEY, DIFFERENTLY_URL
# A sandbox is a context manager that deletes itself on exit.
with client.sandboxes.create(
profile="small",
placement={"strategy": "private-first", "external": "never"},
) as sandbox:
result = sandbox.exec("python3 --version")
print(result.exit_code, result.stdout)
for ev in sandbox.exec_stream("make test"):
print(ev.type, getattr(ev, "data", ""))differently doctor
differently sandbox create --profile small --wait
differently sandbox exec sbx_123 -- 'echo hello from $(uname -s)'
differently sandbox files put sbx_123 ./README.md /work/README.md
# Why a sandbox was placed where it runs
differently sandbox placement sbx_123
# Operator view: endpoints, credentials and external placements
differently admin trust-reportTo run these locally, see Get started.
Capabilities
16 built-in adapters, from self-hosted OpenSandbox to E2B, Vercel and the AWS, Azure and Google Cloud sandbox services, plus a plugin protocol for any other backend. Operators change where work goes; applications keep the same API.
Provider catalog →Registering a managed provider does not authorize its use. Work goes to an external pool only when global, organization and project policy, the data classification and the request all allow it. Quotas are derived from state and enforced at admission; ambiguous cases are denied.
Hybrid overflow guide →Each placement records the pools considered, the ones excluded and why, and how the rest were ranked. One API call returns the explanation for any sandbox.
Placement policy →One report of external endpoints, credentials by reference, external placements, admin actions, audit chain status, and the properties Differently cannot verify itself.
Security and trust model →Project status · v0.1.0-alpha.2
Details: the support matrix, provider catalog, hardening checklist, proofs of concept and the feature parity table.
make build
./bin/differently-server --dev
# in a second terminal
./bin/differently sandbox create --profile small --waitDev mode has no isolation. State is kept in memory and the devhost pool runs commands directly on the host as the current user. Use it to try the API, not for untrusted code.
Apache-2.0, developed in the open by the OpenWork team. Issues and pull requests are welcome.