SaladDay · Nov 3, 2026 · Nov 3, 2026 · Nov 3, 2026 · Nov 3, 2026 · Nov 3, 2026
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -17,6 +17,7 @@ Every subject has one owner. Most owners are the page whose title names the subj
 | Codex, Claude and MiniMax Runtime adapters and images | [Codex](services/core/deploy/codex/README.md), [Claude](services/core/deploy/claude/README.md), [MiniMax](services/core/deploy/mcode/README.md) |
 | Claude private SDK bridge | [Claude SDK adapter](packages/claude-sdk-adapter/README.md) |
 | E2B template construction | [E2B template builder](services/core/deploy/e2b/README.md) |
+| OpenSandbox Runtime image and adapter | [OpenSandbox adapter guide](services/core/deploy/opensandbox/README.md) |
 | E2B and microsandbox Provider helper implementation | [E2B helper](services/core/tools/e2b-provider/README.md), [microsandbox helper](services/core/tools/microsandbox-provider/README.md) |
 | Distribution builds, Runtime image builds, CI and publication | [Build and release OpenAgentCore](docs/maintainers.md) |
 | Website: landing page, bilingual documentation maintenance, documentation site build and GitHub Pages publication | [Website guide](website/README.md) |

diff --git a/README.md b/README.md
@@ -33,7 +33,7 @@ On Windows, in PowerShell:
 irm https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/install.ps1 | iex
 ```
 
-In Web, sign in with the Core key the installer prints, configure the public address, set a default model, issue a Project API key and add sandbox capacity (a node or E2B). [Install Core and Web](https://openagentcore.dev/docs/getting-started/install) covers each step.
+In Web, sign in with the Core key the installer prints, configure the public address, set a default model, issue a Project API key and add sandbox capacity (a node, E2B or OpenSandbox). [Install Core and Web](https://openagentcore.dev/docs/getting-started/install) covers each step.
 
 Then call it with the OpenAI SDK, with `OPENAI_BASE_URL` set to your API base URL (`https://core.example/v1`) and `OPENAI_API_KEY` to the Project API key:
 

diff --git a/README.zh-CN.md b/README.zh-CN.md
@@ -33,7 +33,7 @@ curl -fsSL https://openagentcore.dev/install.sh | bash
 irm https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/install.ps1 | iex
 ```
 
-在 Web 中，用安装程序输出的 Core 密钥登录，配置公共地址，设置默认模型，签发项目 API 密钥，并添加沙箱容量（节点或 E2B）。每一步见[安装 Core 和 Web](https://openagentcore.dev/zh/docs/getting-started/install)。
+在 Web 中，用安装程序输出的 Core 密钥登录，配置公共地址，设置默认模型，签发项目 API 密钥，并添加沙箱容量（节点、E2B 或 OpenSandbox）。每一步见[安装 Core 和 Web](https://openagentcore.dev/zh/docs/getting-started/install)。
 
 然后用 OpenAI SDK 调用，将 `OPENAI_BASE_URL` 设为你的 API 基础地址（`https://core.example/v1`），`OPENAI_API_KEY` 设为项目 API 密钥：
 

diff --git a/apps/web/e2e/public-url.spec.ts b/apps/web/e2e/public-url.spec.ts
@@ -28,10 +28,10 @@ test("explains an E2B rejection in the wizard, with a link to domain setup", asy
   await selectFixtureE2BBuild(page);
   await page.getByRole("button", { name: "Next" }).click();
   const address = page.getByRole("definition").filter({ hasText: "http://127.0.0.1:8091" });
-  await expect(address).toContainText("Set a public address before connecting; E2B sandboxes need an HTTPS one.");
+  await expect(address).toContainText("Set a public address before connecting; E2B sandboxes reach Core through it.");
   await page.getByRole("button", { name: "Save configuration" }).click();
   const rejection = page.locator(".wizard-rejection");
-  await expect(rejection).toContainText("This sandbox provider needs a public HTTPS address.");
+  await expect(rejection).toContainText("This sandbox provider needs a public address.");
   await expect(rejection.getByRole("button", { name: "Managed in Settings" })).toBeVisible();
   // Nothing was saved and nothing is uncertain: no dialog, and the wizard stays on its review.
   await expect(page.getByRole("dialog")).toHaveCount(0);

diff --git a/apps/web/src/features/sandbox/SandboxSetupWizard.tsx b/apps/web/src/features/sandbox/SandboxSetupWizard.tsx
@@ -309,7 +309,7 @@ export function SandboxSetupWizard({ coreUrl, expectedGeneration, current, disab
             <dd>
               {address ? <code>{address}</code> : "—"}
               <span className="wizard-review-sub">{t("Managed in Settings")}</span>
-              {installation.data?.local_only ? <span className="wizard-review-caution">{setup?.public_origin === "required" ? t("Set a public address before connecting; {{provider}} sandboxes need an HTTPS one.", { provider: setup.label }) : t("Set a public address before connecting remote nodes.")}</span> : null}
+              {installation.data?.local_only ? <span className="wizard-review-caution">{setup?.public_origin === "required" ? t("Set a public address before connecting; {{provider}} sandboxes reach Core through it.", { provider: setup.label }) : t("Set a public address before connecting remote nodes.")}</span> : null}
             </dd>
           </div>
         </dl>

diff --git a/apps/web/src/i18n/locales/en/core-errors.ts b/apps/web/src/i18n/locales/en/core-errors.ts
@@ -37,7 +37,7 @@ export const coreErrors = {
   "sandbox_credential_invalid": "The sandbox provider credential was rejected. The saved configuration is unchanged.",
   "sandbox_configuration_invalid": "Select a ready immutable provider configuration with matching resources.",
   "sandbox_verification_unconfirmed": "Sandbox provider verification could not be confirmed. Refresh before submitting again.",
-  "sandbox_configuration_error": "This sandbox provider needs a public HTTPS address. Set OAC_PUBLIC_URL to an HTTPS origin.",
+  "sandbox_configuration_error": "This sandbox provider needs a public address. Set OAC_PUBLIC_URL to an origin its sandboxes reach, not loopback.",
   "sandbox_deployment_conflict": "The sandbox deployment cannot change in its current state. Refresh and check its reset and resource state.",
   "sandbox_specification_mismatch": "The saved sandbox specification does not match the deployment. Refresh to check the configuration.",
   "sandbox_operation_unsupported": "The selected sandbox provider does not support this operation.",

diff --git a/apps/web/src/i18n/locales/zh-CN/core-errors.ts b/apps/web/src/i18n/locales/zh-CN/core-errors.ts
@@ -36,7 +36,7 @@ export const coreErrors = {
   "sandbox_credential_invalid": "沙箱提供商凭据被拒绝。已保存的配置未改变。",
   "sandbox_configuration_invalid": "请选择已就绪且资源匹配的不可变提供商配置。",
   "sandbox_verification_unconfirmed": "无法确认沙箱提供商的验证结果。请刷新后再提交。",
-  "sandbox_configuration_error": "此沙箱提供商需要可从互联网访问的 HTTPS 地址，请把 OAC_PUBLIC_URL 设为一个 HTTPS 源地址。",
+  "sandbox_configuration_error": "此沙箱提供商需要公开地址，请把 OAC_PUBLIC_URL 设为其沙箱可访问的非回环源地址。",
   "sandbox_deployment_conflict": "沙箱部署在当前状态下无法更改。请刷新并检查重置和资源状态。",
   "sandbox_specification_mismatch": "已保存的沙箱规格与部署不一致。请刷新检查配置。",
   "sandbox_operation_unsupported": "所选沙箱提供商不支持此操作。",

diff --git a/apps/web/src/i18n/locales/zh-CN/sandbox.ts b/apps/web/src/i18n/locales/zh-CN/sandbox.ts
@@ -347,7 +347,7 @@ export const sandbox = {
   "Change the sandbox configuration": "修改沙箱配置",
   "The address nodes and sandboxes use to reach Core.": "节点和沙箱访问 Core 使用的地址。",
   "Managed in Settings": "在设置中管理",
-  "Set a public address before connecting; {{provider}} sandboxes need an HTTPS one.": "连接前请先设置公开地址；{{provider}} 沙箱需要 HTTPS 地址。",
+  "Set a public address before connecting; {{provider}} sandboxes reach Core through it.": "连接前请先设置公开地址；{{provider}} 沙箱通过它连接 Core。",
   "Enter the key again to save.": "请重新输入密钥后再保存。",
   "Set a public address before connecting remote nodes.": "连接远程节点前，请先设置公开地址。",
   "Select {{field}}": "选择{{field}}",

diff --git a/apps/web/src/lib/sandbox-labels.ts b/apps/web/src/lib/sandbox-labels.ts
@@ -40,7 +40,7 @@ export function sandboxWriteUncertain(error: unknown): boolean {
 
 /**
  * The reason for a refused deployment configuration whose code the console
- * explains, such as a Provider that needs a public HTTPS address behind a loopback public_url; null for any other failure.
+ * explains, such as a Provider that needs a public address behind a loopback public_url; null for any other failure.
  * Nothing was saved, so the administrator corrects the cause and saves again.
  */
 export function sandboxConfigurationRejection(error: unknown, locale: SupportedLanguage = "en"): string | null {

diff --git a/contracts/agents-api/core-errors.md b/contracts/agents-api/core-errors.md
@@ -66,7 +66,7 @@ Each code returns HTTP 400 with `type: "invalid_request_error"`. A missing, malf
 | `harness_config_invalid` | `harness_config` | omitted | The deployment default's native parameters are unsupported or invalid |
 | `invalid_sandbox_configuration` | `resources.cpus` | `min`: 1, `max`: 255 | The CPU count is outside the supported bounds |
 | `invalid_sandbox_configuration` | `resources.memory_mib` | `min`: 512, `max`: 1048576 | Memory is outside the supported bounds |
-| `invalid_sandbox_configuration` | `resources.root_disk_mib` or `resources.environment_disk_mib` | `min`: 1024 for microsandbox (`environment_disk_mib` also accepts 0); `min`: 0, `max`: 0 for E2B | Disk capacity is missing or unsupported by the provider |
+| `invalid_sandbox_configuration` | `resources.root_disk_mib` or `resources.environment_disk_mib` | `min`: 1024 for microsandbox (`environment_disk_mib` also accepts 0); `min`: 0, `max`: 0 for E2B and OpenSandbox | Disk capacity is missing or unsupported by the provider |
 
 Bounds are validation constants, never submitted values. Node names are limited in bytes; Project and key names in trimmed Unicode characters without control characters. Only the first failure is reported, in this order: model provider URL, protocol, key, limits, then the Harness's protocol; sandbox resources CPU, memory, then disk. Model-provider field errors inside a `model_provider` object keep that object's field as `param`. An unknown sandbox provider returns an error without these fields.
 

diff --git a/contracts/agents-api/environments.md b/contracts/agents-api/environments.md
@@ -8,7 +8,7 @@ Related owners:
 
 - [Environment files](./environment-files.md): the Files API on a live workspace.
 - [Executor credentials](./environment-executor-credentials.md): enrollment, the installation grant and connection status of a `self_hosted` machine.
-- [Sandbox deployment](./sandbox-deployment.md): which Sandbox Provider (E2B or microsandbox) hosts `openai_hosted` Environments.
+- [Sandbox deployment](./sandbox-deployment.md): which Sandbox Provider (microsandbox, E2B or OpenSandbox) hosts `openai_hosted` Environments.
 - [Core–Runtime protocol](../../docs/runtime-protocol.md): the `runtime_prepare` transfer and every other wire message.
 - [Runtime and outer isolation](../../docs/concepts.md#runtime-and-outer-isolation): the daemon runs tools with its launching user's permissions; isolation comes from the outer Environment.
 
@@ -71,7 +71,7 @@ Both placements run the same Runtime: the daemon, the selected Harness, native t
 
 ### Hosted (`openai_hosted`)
 
-The deployment's configured Sandbox Provider (E2B or microsandbox, see [sandbox deployment](./sandbox-deployment.md)) hosts the Environment. [Harness capabilities](./harness-capabilities.md) lists which Harnesses run there.
+The deployment's configured Sandbox Provider (microsandbox, E2B or OpenSandbox, see [sandbox deployment](./sandbox-deployment.md)) hosts the Environment. [Harness capabilities](./harness-capabilities.md) lists which Harnesses run there.
 
 - Session creation, with or without initial input, commits the Session, Environment and retry identity before the Worker provisions compute. A creation interrupted before bootstrap is recovered without repeating the Provider's Create.
 - Provisioning needs no caller action; the Session stays idle until a Turn starts.
@@ -313,6 +313,7 @@ Limits ([adapter rules](../../docs/sandbox-provider.md#network-egress)):
 
 - A model provider host that the cap lists, by name or through a `*.` entry, is reachable like a listed domain, not only on its port.
 - On E2B, a restricted domain is reachable only on ports 80 and 443, and a model provider on another port is reachable on every port of its public addresses.
+- On OpenSandbox, the Core host, an allowed domain and the model provider host are reachable on every port of their public addresses.
 
 `disabled` and `restricted` return `sandbox_network_unsupported` when the deployment's sandbox Provider cannot restrict egress. A `self_hosted` Environment accepts only `enabled`, because Core cannot enforce a policy on a machine it does not run.
 

diff --git a/contracts/agents-api/harness-capabilities.md b/contracts/agents-api/harness-capabilities.md
@@ -12,7 +12,7 @@ Anything this page does not list follows the Harness's native behavior with the
 | Admitted | Core admits it through the same Runtime path, but no real-model acceptance has run on that placement |
 | Rejected | Core rejects the request before execution |
 
-Placements are `none` (no Environment), hosted (`openai_hosted`) and self-hosted (`self_hosted`). E2B and microsandbox run the same Runtime and adapters, and every Verified hosted cell counts as Admitted on both. Self-hosted acceptance ran on Linux machines; the [self-hosted guide](../../docs/getting-started/self-hosted.md#platforms) lists the supported platforms. A verified operation is verified on its own, not in every combination with other options; combinations that a profile rejects are listed in the operation's contract.
+Placements are `none` (no Environment), hosted (`openai_hosted`) and self-hosted (`self_hosted`). microsandbox, E2B and OpenSandbox run the same Runtime and adapters, and every Verified hosted cell counts as Admitted on each. Self-hosted acceptance ran on Linux machines; the [self-hosted guide](../../docs/getting-started/self-hosted.md#platforms) lists the supported platforms. A verified operation is verified on its own, not in every combination with other options; combinations that a profile rejects are listed in the operation's contract.
 
 ## Execution and input
 
@@ -65,4 +65,4 @@ These operations need a workspace, so they apply to hosted and self-hosted place
 | [Plugin MCP over stdio](./environments.md#plugin-mcp) | Verified: hosted, self-hosted | Verified: self-hosted; admitted: hosted | Verified: self-hosted; admitted: hosted |
 | Plugin MCP over HTTP | Admitted, with literal headers or HTTPS bearer | Admitted, with literal headers or HTTPS bearer | Verified: self-hosted; admitted: hosted; literal headers or HTTPS bearer |
 
-External workspace storage additionally requires the selected Harness declaration and Runtime to support `retained_native_history`; E2B, which keeps its own disks, does not. microsandbox always uses external storage, so MiniMax Code, which does not declare the capability, cannot run on it. The [Workspace filesystem protocol](../../docs/workspace-provider.md) owns storage combination admission.
+External workspace storage additionally requires the selected Harness declaration and Runtime to support `retained_native_history`; E2B and OpenSandbox, which keep their own disks, do not. microsandbox always uses external storage, so MiniMax Code, which does not declare the capability, cannot run on it. The [Workspace filesystem protocol](../../docs/workspace-provider.md) owns storage combination admission.
diff --git a/contracts/agents-api/harness-onboarding.md b/contracts/agents-api/harness-onboarding.md
@@ -34,7 +34,7 @@ flowchart TB
 | Declaration | The Harness's maximum capabilities, placements, configuration and pure admission restrictions, read by Core admission and the Runtime | `internal/harnessconfig/<package>/declaration.go` |
 | Runtime binding | The declaration plus discovery, installed factories and verified capabilities | `apps/daemon/internal/agent/<package>/declaration.go` |
 
-An Environment supplies execution resources. Managed E2B and microsandbox machines and application-owned machines differ in provisioning and connection; the connected Runtime uses this same contract. The daemon runs on Linux, macOS and Windows, managed Providers are Linux-only, and each adapter qualifies its own platforms ([self-hosted platforms](../../docs/getting-started/self-hosted.md#platforms)). Native factories receive capabilities only after the Runtime has loaded the bound installed snapshot ([capability preparation](./environments.md#runtime-capability-preparation)). Model providers supply model communication settings, not Turn scheduling or native process ownership.
+An Environment supplies execution resources. Managed microsandbox, E2B and OpenSandbox machines and application-owned machines differ in provisioning and connection; the connected Runtime uses this same contract. The daemon runs on Linux, macOS and Windows, managed Providers are Linux-only, and each adapter qualifies its own platforms ([self-hosted platforms](../../docs/getting-started/self-hosted.md#platforms)). Native factories receive capabilities only after the Runtime has loaded the bound installed snapshot ([capability preparation](./environments.md#runtime-capability-preparation)). Model providers supply model communication settings, not Turn scheduling or native process ownership.
 
 ## Steps
 

diff --git a/contracts/agents-api/machine-api.md b/contracts/agents-api/machine-api.md
@@ -60,7 +60,7 @@ oac-daemon connect --profile default
 - A new node sends its enrollment token without `X-OAC-Node-ID`. The token must be valid, unexpired, unconsumed and issued by this installation. An active reset refuses this read.
 - A registered node sends its node credential and its UUID in `X-OAC-Node-ID`. Without a query it reads the current target. `?generation=N` reads only a generation this node may still need: the current target, its serving pin, or one held by an unreleased allocation or placement on it; any other generation is refused. This read stays available during a reset, for owned recovery.
 
-The response has `installation_id`, `provider`, `core_url` (the installation public URL), `generation`, `specification` and `specification_digest`. It never contains an administrator, Project or E2B credential, and exists only for node-backed providers. The [sandbox deployment contract](./sandbox-deployment.md#canonical-node-specification) defines the specification and its digest.
+The response has `installation_id`, `provider`, `core_url` (the installation public URL), `generation`, `specification` and `specification_digest`. It never contains an administrator, Project or Sandbox Provider credential, and exists only for node-backed providers. The [sandbox deployment contract](./sandbox-deployment.md#canonical-node-specification) defines the specification and its digest.
 
 ### Enroll a node
 

diff --git a/contracts/agents-api/runtime-observability-api.md b/contracts/agents-api/runtime-observability-api.md
@@ -117,7 +117,7 @@ This returns one `RuntimeObservation`, without `disk`. It accepts no query param
 
 ### `disk`
 
-Only list rows carry `disk`: null, or `{usage_bytes, limit_bytes}` with the rules of `memory`. E2B fills it when the sandbox reports both its disk usage and a nonzero capacity. microsandbox returns null. A non-null `disk` appears only on an `observed` row.
+Only list rows carry `disk`: null, or `{usage_bytes, limit_bytes}` with the rules of `memory`. E2B fills it when the sandbox reports both its disk usage and a nonzero capacity. microsandbox and OpenSandbox return null. A non-null `disk` appears only on an `observed` row.
 
 ### Status and reason
 
@@ -190,7 +190,7 @@ There is one series per managed allocation, keyed by `allocation_id`, so a provi
 
 Each point has the bucket bounds, the coverage counts of the allocation's samples, and nullable `cpu` and `memory` objects with a `contributor_count` of at least 1:
 
-- `cpu.utilization_ratio` comes from consecutive cumulative CPU counters of one compute incarnation: the CPU seconds consumed divided by the elapsed time multiplied by the capacity, over the intervals that end in the bucket. The baseline resets when the incarnation changes or a counter decreases. E2B reports no cumulative CPU time; its bucket value is the mean of the ratios sampled in it. `cpu.capacity_cores` is the last capacity in the bucket.
+- `cpu.utilization_ratio` comes from consecutive cumulative CPU counters of one compute incarnation: the CPU seconds consumed divided by the elapsed time multiplied by the capacity, over the intervals that end in the bucket. The baseline resets when the incarnation changes or a counter decreases. E2B and OpenSandbox report no cumulative CPU time; their bucket value is the mean of the ratios sampled in it. `cpu.capacity_cores` is the last capacity in the bucket.
 - `memory.usage_bytes` and `memory.limit_bytes` are the last values observed in the bucket.
 
 Disk is not kept in history.