Get started in Python#
Embed the Bashkit sandbox in a Python application or agent. The package ships as pre-built binary wheels on PyPI, install and go, no Rust toolchain needed.
Install#
pip install bashkit
First script#
from bashkit import Bash
bash = Bash()
result = bash.execute_sync("echo 'Hello, World!'")
print(result.stdout)
Persistent state#
A Bash instance keeps its environment and virtual filesystem across calls:
from bashkit import Bash
bash = Bash()
bash.execute_sync("export APP_ENV=dev")
print(bash.execute_sync("echo $APP_ENV").stdout) # dev
Sync vs async#
execute_sync() runs scripts that complete without suspending, plain bash and
jq. If you register an async custom builtin (e.g. one that issues an HTTP
request), use the awaitable execute() instead:
result = await bash.execute("echo hi | my_async_tool")
Embedded Python and TypeScript#
Native wheels can run Python and TypeScript inside the shell. Both runtimes
are disabled by default; opt in with python=True and typescript=True.
Python also requires a host-supplied environment gate:
from bashkit import BashTool
bash = BashTool(
python=True,
typescript=True,
env={"BASHKIT_ALLOW_INPROCESS_PYTHON": "1"},
)
assert bash.execute_sync("python -c 'print(42)'").stdout == "42\n"
assert bash.execute_sync("ts -c '42'").stdout == "42\n"
Scripts cannot grant Python permission by exporting the gate variable. Runtime
flags survive reset(); supply them again when constructing from a snapshot.
LangChain’s BashkitTool and deepagents’ middleware/backend accept the same
flags.
This differs from embedding Bashkit in your Python application; see the Python builtin and TypeScript builtin guides.
Examples#
Runnable Python examples in the repo:
bash_basics.py, first scripts and persistent statedata_pipeline.py, pipes and data processingllm_tool.py, exposing Bashkit as an LLM tool- Agent integrations: deepagents, Pydantic AI
Next steps#
- Sandbox configuration & limits, resource limits and sandbox options.
- LLM tools, expose Bashkit as a sandboxed tool for agent frameworks.
- Security, sandbox boundaries and what scripts cannot do.