mensfeld/code-on-incus

Give each AI agent its own isolated machine with root, Docker, and systemd. Active defense detects and stops threats automatically.

What it solves

Code on Incus (COI) provides a secure, isolated environment for AI coding agents to operate in. It prevents AI agents from having direct access to your host system, protecting your sensitive credentials, SSH keys, and environment variables while still giving the agents the full system-level access (root, Docker, package managers) they need to perform complex coding tasks.

How it works

COI uses Incus system containers—which behave like lightweight virtual machines with full init systems—rather than standard application containers. Each AI agent session is given its own container with its own home directory and a mounted project workspace.

To maintain security, COI implements:

  • Active Defense: Kernel-level monitoring using nftables to detect and automatically respond to threats like reverse shells, data exfiltration, and credential scanning by pausing or killing the container.
  • Credential Isolation: Host credentials are never exposed by default; they are only provided via explicit mounts or secure forwarding (like SSH agent forwarding).
  • Protected Paths: Critical project files (like .git/config and .vscode settings) are mounted as read-only to prevent supply-chain attacks.
  • Sandbox Context: An auto-injected file (SANDBOX_CONTEXT.md) informs the AI tool about its restricted environment.

Who it’s for

Developers who use AI coding agents (such as Claude Code, OpenCode, or pi) and want to grant them full machine access without risking their host system's security or stability.

Highlights

  • Full System Access: Agents get root access and Docker support within the container.
  • Real-time Threat Detection: Automatically pauses or kills containers upon detecting high-risk network activity.
  • Parallel Sessions: Support for multiple isolated "slots" for the same workspace.
  • Persistence: Containers can be persistent or ephemeral, with workspace changes always saved.
  • Host Integration: Securely forwards SSH agents, specific TCP ports, and Unix sockets.
  • Snapshotting: Ability to create checkpoints and rollback changes to the container state.

Related

  • Project
    nikvdp/cco

    A sandboxing wrapper for Claude Code and other AI coding agents that provides secure isolation using native OS tools or Docker without sacrificing autonomous productivity.

  • Project
    h5i-dev/h5i

    A lightweight, pure-Rust browser for AI agents that provides policy-controlled network access, detailed auditing, and multiple tiers of sandboxing.

  • Dispatch
    Securing AI Agents with Isolated Docker Sandboxes

    An exploration of agent-sandbox, a tool designed to run AI coding agents within isolated Docker containers to prevent unauthorized system access and ensure execution safety.

  • Project
    finbarr/yolobox

    A containerized sandbox for AI coding agents that allows them to run commands with sudo privileges while protecting the host's home directory from accidental destruction.

  • Project
    opensandbox-group/OpenSandbox

    A general-purpose sandbox platform for AI applications that provides secure, isolated environments for code execution, agent evaluation, and RL training.