← Projects

Active · server preview

AgentBox

Isolated environments for coding agents, with an explicit workspace and private state.

Technologies
Python · Podman / Docker · Git worktrees
My contribution
My project under vojtabiberle; development environment design and its security boundaries.
Sources checked

Repository ↗ · Documentation ↗

Local execution / simplified
  1. WorkspaceExplicit mount
  2. ContainerPodman / Docker
  3. AgentPrivate HOME

worktree ≠ sandbox

The problem

A coding agent needs to execute commands, edit files and install dependencies. On a development laptop it can easily gain more access than the task requires. AgentBox separates the workspace, agent state and explicitly mounted context from the rest of the machine.

Architecture and decisions

The local profile runs Claude Code, Hermes, Codex or Aider through Podman or Docker. Each workspace/agent pair has its own persistent HOME. Additional mounts and forwarded environment variables are explicit; host login credentials are not shared automatically. Git worktrees separate changes in progress, not process permissions.

Local runs have network access by default. The server profile has a different trust boundary: administrator policy, rootless Podman, temporary HOME and no direct IP network. An optional broker mediates bounded requests without handing provider credentials to the workload. Project Dockerfiles are not trusted server configuration.

Delivered work and remaining limits

Public documentation describes an always-on server preview and a reference review controller. The DEV pilot reports verified isolation and a one-shot diff review through Anthropic, without publishing a comment. Secret rotation, scheduled triggers and publication remain acceptance work.

This is not a finished orchestrator for arbitrary models. Builder integration, approval gates and independent multi-model reviews remain work to do, rather than capabilities I want to promise here.

Tradeoffs

Containers share the host kernel. A container alone is not a complete security boundary for untrusted code. Mounts, networking, resource limits and broker permissions matter. The persistent local profile and server preview have different threat models and should not be treated as interchangeable.

The project uses BSL 1.1. Check the licence for usage terms; I do not describe it as open source by default.

Connections

My approach to agentic development · coding-worker: delegating tasks through MCP