Containarium: isolated boxes for AI agents
Containarium
A platform on your own server that gives each agent its own Linux box with SSH and MCP tools for commands and files
- 313 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- shell_exec runs arbitrary commands in the box, and the platform MCP manages containers, networking and secrets
- The installer runs as root and the admin token is stored on the host
Install
- Works in
Manual install
curl -fsSL https://containarium.dev/install.sh | sudo bashInstalls the daemon and the CLI on Ubuntu 24.04. Then run containarium quickstart alice.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- shell_exec runs arbitrary commands in the box, and the platform MCP manages containers, networking and secrets
- The installer runs as root and the admin token is stored on the host
This is third-party code. Review the repository files before installing.
What it does
Containarium gives each agent its own persistent Linux box in an unprivileged container, reachable over SSH. The platform runs on LXC or Kubernetes. The containarium CLI creates boxes, sets up SSH access and exposes a box port on a public hostname. Two MCP servers lead to the agent. The first, agent-box, runs inside the box over stdio and offers shell_exec for commands plus five file tools. The second, the platform server, runs on the host and mirrors the CLI, from container management to backups. The token's scopes decide which tools a client sees. The `containarium quickstart alice` command creates a box, wires up SSH and writes the MCP config for Claude Code. For Gemini and Codex add the `--agent` flag; for Cursor you add the entry to ~/.cursor/mcp.json by hand. The platform can also restrict a box's outbound traffic with an eBPF policy and keep model-provider keys out of the box through a gateway.
Who it is for. For developers and teams who want to run agents on separate persistent machines on their own server, away from their work laptop.
Good fit when
- The agent needs a full Linux environment with systemd and networking where it installs packages and starts services
- You need isolation: a bad install must not touch your laptop or cluster
- The agent should publish a built site on a public hostname with one command
- You want to issue the agent a token with only the scopes it needs
- You have a GPU to pass through into the agent's container
Not a fit when
- You need a short sandbox for a single command: the platform is built for persistent boxes and needs a dedicated server
- You have no Ubuntu 24.04 server with sudo: installation requires a host with Incus 6.19 or newer
- You want a ready cloud sandbox with no administration: the project has a hosted option, but it is a separate service
- You need protection from the agent's actions inside the box itself: commands there are unrestricted
Example request
Create a sandbox called blog, install Caddy on port 8080 inside it and expose it at blog.example.com.MCP
- Transport
- stdio
- Authentication
- API key
Environment variables
CONTAINARIUM_TOKENrequired, secret- Access token for the daemon. The installer saves the admin token to /etc/containarium/admin.token.
CONTAINARIUM_SERVERrequired- The daemon API address, for example http://localhost:8080.
AGENTBOX_ROOT- The directory to which agent-box restricts file operations.
Limitations
Installation assumes a fresh virtual machine with Ubuntu 24.04, sudo rights and Incus 6.19 or newer. It needs the overlay, br_netfilter and nf_nat kernel modules, and ZFS for disk quotas. The installer sets up the daemon and the CLI with one script run as root.
The eBPF egress policy is off by default and switched on separately. The Kubernetes backend is still experimental. The shell in agent-box is limited only by the container, and the AGENTBOX_ROOT variable narrows only the file tools. We have not checked whether the install script and the hosted service are reachable from Russia.
How to disable. Remove the containarium-box entry from the client's MCP config (in Claude Code with `claude mcp remove`). Delete boxes with containarium delete and stop the daemon with systemctl stop containarium.
FAQ
How do I connect Containarium to Claude Code?
After installing the platform run containarium quickstart alice: it creates a box and writes the MCP config for Claude Code. Then containarium code install alice puts agent-box and Claude Code into the box. Check that claude mcp list shows containarium-box.
Which tools does agent-box provide?
Six. shell_exec has a time limit (30 seconds by default, 10 minutes at most) and an output cap (256 KiB). The file tools read, write, list, move and delete files. write_file writes atomically, and delete_file refuses to remove directories.
How is Containarium different from AIO Sandbox?
AIO Sandbox packs a browser, terminal and files into one Docker container. Containarium provides persistent SSH-reachable Linux boxes on LXC or Kubernetes, can publish ports on a hostname and issues tokens with limited scopes.
What does self-hosting require?
A fresh Ubuntu 24.04 server with sudo. Run the installer with curl -fsSL https://containarium.dev/install.sh | sudo bash. Without a server of your own you can use the hosted option at cloud.containarium.dev.
How do I restrict a box's outbound traffic?
The eBPF policy is switched on per tenant. Denials are written to the audit log, and details are in the repository's docs/security/CLAIMS.md file.
Discussion
No questions or reviews yet.
Related
MCP serversA secure MCP runtime through which an agent operates local machines, servers and containers
1C AI sandbox client-server
1c-ai-sandbox-client-server
A devcontainer plus a Hyper-V VM with a 1C server that isolate an AI agent from the host machine so a wrong command cannot touch real files or drives
The MCP server of the purple SSH manager: an agent reads hosts from ~/.ssh/config and their containers, commands and container control are opt-in
Container by Aerovato
Container
A CLI for persistent per-project Linux workspaces in Docker or Podman that keep the agent away from the rest of your system
MCP server for Kubernetes: the agent reads cluster state, diagnoses pod failures and runs operations through kubectl
AWS's official set of MCP servers, skills and plugins so an agent can build, deploy and operate on AWS
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Containarium: isolated boxes for AI agents (this entry) | yes | API key | 313 | |
| AIO Sandbox | no | key is optional | 6,247 | a single Docker container with a browser, terminal and files for running agent actions safely |
| Fence | yes | 1,005 | runs agent commands in a sandbox with the network blocked by default on your own machine |
README in short
The path from install to the first box takes three steps with a check after each. The project is also compared with cloud sandboxes and Docker AI Sandboxes.