# kosa8

> Sandbox platform that gives each AI agent its own sealed, checkpointable virtual machine with a closed network and audit evidence.

kosa8 is a container and sandbox platform for AI agents, published at kosa8.com. Each agent runs in its own sealed machine that can be saved, copied, forked and rewound, and it installs with a one-line shell command. It runs on Apple-silicon Macs and x86-64 Linux, and on Windows 11 through WSL2 (preview).

## What It Is

kosa8 treats a whole machine as the unit of work: a real VM with its own kernel and disk, rather than a container sharing a host kernel. Users start a coding agent such as Claude Code, Codex or Gemini with a command like `kosa8 agent run claude`. The agent sees only the workspace folder it is given. The network is closed except for an allow-list, and API keys are brokered so the sandbox holds a placeholder instead of the real key. It also works with the Docker CLI and Compose through a Docker-compatible API.

## Checkpoint, Rewind and Fork

Checkpoints capture the entire machine, including memory and running processes. Rewinding resumes processes from the saved instant rather than restarting. The site's own examples show a checkpoint in about 697 ms and a rewind in about 485 ms. A running machine can be forked into several parallel branches, and the `explore` command runs variants and reports which branch won.

## Governance and Evidence

For regulated teams, kosa8 documents hash-chained action records marked as human or agent, signed approvals by one or two named approvers, signed organisation policies, CUI labels, FIPS 140-3 builds, offline licences and air-gapped operation. Evidence can be exported as signed packages that a third party can verify. A lab mode detonates malware samples in a sealed VM with a simulated internet and produces signed reports.

## Local Models

kosa8 can pull a model from Hugging Face and serve it locally through OpenAI-compatible and Anthropic-compatible endpoints. Vendor-stated benchmark figures include a 178 ms container start and an 897 ms sandbox restore. The site says shared host folders read at about a third of native speed.

## Features
- Per-agent sealed VM with its own kernel and disk
- Whole-machine checkpoint and rewind including running processes
- Fork a running machine into parallel branches
- Egress allow-list with closed network by default
- API key brokering so sandboxes hold only placeholders
- Docker CLI and Compose compatible API
- Ready-made kits for Claude Code, Codex and Gemini
- Hash-chained audit records and signed evidence export
- Signed org policies and two-person approvals
- Malware detonation lab with signed reports
- Local model serving with OpenAI- and Anthropic-compatible APIs
- Air-gapped and offline-licence operation

## Integrations
Claude Code, Codex, Gemini, Docker, Docker Compose, Hugging Face, MCP servers, OpenAI API, Anthropic API

## Platforms
WINDOWS, MACOS, LINUX, WEB, API, CLI

## Pricing
Subscription-based

## Links
- Website: https://kosa8.com
- Documentation: https://docs.kosa8.com/
- EveryDev.ai: https://www.everydev.ai/tools/kosa8