ExitBox CLI
ExitBox runs Claude, Codex, Cursor and other agents in rootless containers: a domain allowlist and secrets in an encrypted vault.
- 107 ★ on the repository
- Last commit
- AGPL-3.0
Extended access
Why this level
- The binary is downloaded and run directly, and the vault releases secrets to the agent after approval.
- The agent in the container gets the project and the imported config.
Install
- Works in
Manual install
mkdir -p ~/.local/bin && curl -fsSL https://github.com/Cloud-Exit/ExitBox/releases/latest/download/exitbox-$(uname -s | tr A-Z a-z)-$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/') -o ~/.local/bin/exitbox && chmod +x ~/.local/bin/exitboxLinux and macOS install from the README: downloading the release binary; then `exitbox setup`.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The binary is downloaded and run directly, and the vault releases secrets to the agent after approval.
- The agent in the container gets the project and the imported config.
This is third-party code. Review the repository files before installing.
What it does
ExitBox is a Go CLI for running AI agents in containers. The `exitbox run claude` command builds an image on first run, imports an existing config from `~/.claude` or `~/.codex`, mounts the project directory and starts a Squid proxy with a strict domain allowlist. It supports Claude, Codex, Copilot, Cursor, Kimi, OpenCode, Pi and Qwen. Containers run without root through Podman, with Docker as a fallback. An agent can request a new domain with `exitbox-allow`, and the host approves it in a popup. An encrypted vault (AES-256 and Argon2id) releases secrets on approval, and workspaces separate credentials, for example personal and client ones.
Who it is for. Developers and security engineers who run coding agents on a work machine and want to limit their network and secret access.
Good fit when
- An agent runs in someone else's repository and should not touch the home directory.
- Different clients need separate credentials and vaults.
- An agent should reach only agreed domains.
- A `gh` token should reach the agent only after approval.
Not a fit when
- You need to work without a container engine: Podman or Docker is required.
- The agent must roam the network freely without approval prompts.
- The AGPL-3.0 license does not fit your product.
Example request
Run Codex through ExitBox in this project and allow only the `api.openai.com` and `github.com` domains.Limitations
A Podman or Docker engine is required. The first image build takes time. An agent inside the container can still read and write vault secrets through IPC, so protection rests on the host's approval, not the vault alone. Some features depend on the agent, and AGPL-3.0 sets conditions on distributing changes. Installation downloads a binary from releases, so verify its signature or hash before running.
How to disable. Stop the containers, clean up with `exitbox clean`, remove the `~/.local/bin/exitbox` binary and, if needed, images and volumes.
FAQ
Which agents does it support?
Claude, Codex, Copilot, Cursor, Kimi, OpenCode, Pi and Qwen. Launch with `exitbox run <agent>`.
How does an agent get access to a new domain?
Through `exitbox-allow` inside the container, and the host approves the request in a popup.
Is root required?
No, containers are rootless on Podman; Docker is the fallback.
How does `gh` sign-in work?
Before launch ExitBox offers to store `GITHUB_TOKEN` in the vault, and inside the container it provides it as `GH_TOKEN` after approval.
What does `exitbox setup` do?
It starts the first-time wizard: roles, languages, tools, agents, firewall and vault in one pass.
Discussion
No questions or reviews yet.
Related
CLI toolsAgentBox runs Claude Code, Codex and Open Code in separate virtual machines on your PC, a self-hosted server or a cloud.
A container for Claude Code, Codex, Copilot, OpenCode and Pi: the agent runs without prompts while a gateway limits network.
Runs each agent stage in its own micro-VM: Claude, Codex, Ollama or any CLI, with OTLP tracing
A Docker sandbox for coding agents: a Debian image with Copilot CLI, Codex and Pi, and SSH, RDP and Docker enabled by flags.
A CLI that runs Claude Code and Codex in isolated Docker containers with a firewall, worktrees and a no-Dockerfile image.
ClaudeBox runs Claude Code in Docker with language profiles, session slots and a firewall with an allowlist of addresses.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| ExitBox (this card) | no | 107 | ||
| Agent-Sandbox | no | key is optional | 232 | a general agent sandbox, while ExitBox adds a Squid proxy with on-request domains and an encrypted vault |
| Agentbox | no | 154 | container launch for agents, while here workspaces and secret approvals through popups |
README in short
The README opens with a quick start, then lists features: rootless containers, proxy, domain requests, vault, workspaces. Installation and GitHub CLI integration follow.