Terrarium
Self-hosted, single-tenant runtime for autonomous Claude Code agents.
Every session runs the real Claude Code engine, driven by the Claude Agent SDK, inside an ephemeral sandbox behind a per-session egress firewall. The credential is injected at the network boundary and never enters the sandbox.
Features
| Feature | Detail |
|---|---|
| Hardened sandbox | Non-root, CapEff=0, seccomp, no service-account token, kernel egress default-drop, DNS cut. |
| Credential isolation | Warden injects the real token at egress. The sandbox holds a decoy behind a generic corporate-proxy CA. |
| Live egress control | Allow, deny, inspect and kill, applied to running sessions rather than only new ones. |
| Durable sessions | Reattach to live sandboxes across orchestrator restarts. |
| Rewind and edit | Restore the workspace or the conversation to any past turn. |
| Signed audit | An HMAC-chained receipt per connection, verifiable after the sandbox is gone. |
| Concurrent runs | An agent is configuration; parallel sessions isolate their memory automatically. |
Documentation
- Quickstart — run it locally with Docker.
- Architecture — control plane, sandbox, session flow.
- Security model — the isolation layers and their limits.
- Configuration — environment variables.
- SDK — the Python client.
- Deployment — Docker, Kubernetes, or a single VPS.
Status
Pre-1.0. The API surface is not frozen, and the Kubernetes path ships no reference manifests (see Deployment). Breaking changes are flagged in the release notes.