coipond/coi

Give the agent a machine. Just not yours. Each AI coding agent gets its own isolated machine with root, Docker, and systemd - active defense detects and stops threats automatically.

What it solves

Coi provides a secure, isolated environment for running AI coding agents (such as Claude Code or Codex) without risking the host machine. It prevents agents from accessing sensitive credentials, SSH keys, and environment variables, while allowing them full root access and system-level capabilities within a controlled Linux container.

How it works

Coi uses Incus system containers to create a lightweight, full-OS environment that behaves like a virtual machine but starts in seconds. It mounts the project directory to the container while ensuring file ownership remains correct on the host. To protect the host, it implements kernel-level monitoring to detect and automatically pause or kill containers upon detecting threats like reverse shells or data exfiltration, and uses nftables for network egress control.

Who it’s for

  • Developers who use AI coding agents and want them to have full machine access (root, Docker, package managers) without compromising host security.
  • Users who need to run multiple isolated agents in parallel for the same project.
  • Teams who want to share standardized, persistent development environments via configuration files.

Highlights

  • System-level isolation: Uses Incus to provide a full OS with root and native Docker support inside the sandbox.
  • Active defense: Real-time kernel-level monitoring that auto-pauses or auto-kills sessions based on threat severity.
  • Credential protection: Host SSH keys and tokens are excluded by default unless explicitly forwarded.
  • Reusable Profiles: Named setups for images, resource limits, and network modes that can be applied with a single flag.
  • Coded Guardrails: Read-only mounts for git hooks and IDE configs to prevent agents from modifying supply-chain settings.
  • Headless Orchestration: Ability to run prompts to completion for CI/CD or cron jobs with JSONL audit logs for security forensics.

Related

  • Project
    Soulmate-Halo/heterogeneous-gpu-pd-lab

    A benchmark/research repo that demonstrates a two‑stage heterogeneous GPU pipeline (Prefill on two RTX 6000D GPUs, Decode on four DGX Spark GPUs) for long‑context LLM inference, reporting up to 16 300 tok/s Prefill and 442 tok/s Decode throughput.

  • Project
    ckreiling/mcp-server-docker

    An MCP server that enables LLMs to manage Docker containers, images, and volumes using natural language commands.

  • Project
    kaochenlong/spectra-app

    A Spec-Driven Development tool consisting of a desktop app, CLI, and AI agent skills to visually track and manage specifications, change proposals, and tasks.

  • Project
    slee-persis/GVS5H

    GVS5H is a research codebase that orchestrates multiple calls of a single LLM (e.g., Qwen‑3.8‑27B) to decompose and solve hard coding problems from LiveCodeBench. Using a shared filesystem “ledger,” the method requires no extra training and achieves frontier‑level accuracy (≈92 % pass@1) at a fraction of the cost of proprietary models. The repo provides scripts to run the benchmark with any API‑accessible model, outputs results in JSON, and is MIT‑licensed (paper and data CC‑BY 4.0).