Microsoft's Quicksand puts local coding agents inside a pip-installable QEMU VM

Quicksand is a Python API for rootless, Docker-free QEMU VMs with snapshots and network off by default, for developers running agents locally.

Picture a freelance developer with a client's Django repo and a coding agent in her terminal. She wants the agent to grind through a dependency upgrade unattended: install packages, run the test suite, fix, repeat. Today she has two bad options. She can approve every shell command, which defeats the point of an agent. Or she can skip permissions on her own laptop, where her SSH keys and cloud credentials sit one cat away from a prompt-injected README. Her agent's built-in sandbox helps, but it runs on her host kernel. Docker isn't installed on this machine, and she'd rather not add a daemon just to contain one agent. When the agent wrecks the environment halfway through, she rebuilds it by hand.

That's the gap Quicksand aims at. Microsoft's README describes it as "an async Python API to launch, control, and snapshot QEMU virtual machines with a particular focus on sandboxing AI agents." It installs with pip, needs no root or Docker, starts with networking isolated, and can roll a whole VM back to a checkpoint. At least one other Microsoft project already relies on it: Hysen Labs' write-up of MagenticLite says Magentic-UI runs its browser sessions inside a Quicksand VM.

What it is

According to the README, here is what ships, mapped to the pain above:

The alternatives, each described from its own source:

Who it's for

Pick it up if you write Python, run agents on your own machine, and want a real VM boundary with snapshots without installing Docker or granting root. It fits people building their own agent harness, anyone running more than one agent (the Developers Digest comparison recommends a single boundary such as a VM around all of them, since each built-in sandbox covers only its own agent's commands), and anyone prototyping computer-use agents who wants the browser off the host.

Skip it if you use one CLI agent and its built-in sandbox, with credential paths denied, already does the job. Skip it if Docker is already on your machine and you want agent integrations out of the box; Docker Sandboxes is closer to that. Skip it if you need hosted scale, forking or team-shared infrastructure. And hold off if your company requires a vetted license: the README text we reviewed doesn't state one.

Before and after

Before:

  1. The agent runs on your host as you.
  2. You either approve each command or turn approvals off.
  3. If you enable the built-in sandbox, reads stay wide by default; Claude Code's docs, as summarized by Developers Digest, say sandboxed commands can read "most of the machine," including ~/.ssh, until you deny those paths.
  4. A bad apt install or broken virtualenv means rebuilding by hand.

After, using the calls the README shows:

  1. Boot a Sandbox from an image such as quicksand-agent, mounting only the project directory.
  2. Route the agent's shell commands through sb.execute(), which returns stdout and exit_code.
  3. Call checkpoint() before a risky step; revert() if it goes wrong.
  4. Switch to NetworkMode.FULL only for the run that needs internet.
  5. save() a working environment and boot from it next time.

Step 2 is your code. The sources don't show a ready-made hook for Claude Code, Codex or Copilot CLI, so you're writing the bridge between your agent's tool calls and the VM.

Try it

The README gives a one-line install that bundles QEMU and the Alpine image:

pip install 'quick-sandbox[qemu,alpine]'

Or install the core package and add pieces separately:

pip install quick-sandbox
quicksand install qemu alpine

Its first program:

import asyncio
from quicksand import Sandbox

async def main():
    async with Sandbox(image="ubuntu") as sb:
        result = await sb.execute("echo 'Hello from the sandbox!'")
        print(result.stdout)

asyncio.run(main())

That example boots ubuntu, so you'd also need quicksand install ubuntu, or change it to image="alpine" to match the install above. Then the rollback loop, inside the same async with block:

await sb.checkpoint("before-experiment")
await sb.execute("apt install -y something-risky")
await sb.revert("before-experiment")  # the VM snaps back to the checkpoint

Budget for downloads. Per the README's table for the September 14, 2026 releases, alpine is about 82–85 MB, ubuntu about 309–357 MB, and quicksand-cua about 489–500 MB on top of its bases. The README says the bundled runtime covers "supported platforms" but, in what we reviewed, doesn't list per-OS prerequisites or hardware acceleration requirements. Its Performance guide is listed as covering "TCG vs KVM." The only version evidence is Magentic-UI's pin of quick-sandbox[qemu,cua]~=0.11.14, per Hysen Labs. The sources don't mention pricing.

Where it breaks

Bottom line: Quicksand offers a full-VM boundary and undo for agents you run locally, at the cost of writing your own integration and accepting undocumented performance and licensing.

Sources