containarium

Containarium is an open-source, self-hostable agent runtime that gives each AI agent a persistent, SSH-reachable Linux container with per-tenant network isolation. Agents (Cursor, Claude Code, OpenCode, or custom MCP clients) interact with their box via two MCP servers: an in-container `agent-box` server exposing `shell_exec`, `read_file`, `write_file`, `list_directory`, `move_file`, `delete_file`, and CI context resources; and a platform `mcp-server` on the host for container lifecycle (`create_container`, `list_containers`, `expose_port`, etc.). The same operations are available through the `containarium` CLI. Architecture centers on a lightweight sentinel VM (e.g., GCP e2-micro) running sshpiper for SSH routing by username and Caddy with PROXY-protocol for HTTPS/TLS termination. Backend pools can be LXC/Incus containers on Ubuntu/Rocky/RHEL (with ZFS snapshots, daily backups, 30-day retention) or Kubernetes pods (StatefulSet + headless Service + default-deny NetworkPolicy, `automountServiceAccountToken:false`, restricted Pod Security profile). Both backends share the same CLI, MCP surface, JWT auth (iss/aud/jti/scopes, single-use refresh tokens, jti revocation), RBAC, and REST/gRPC API. GPU passthrough works on bare-metal and K8s (`nvidia.com/gpu`). Security features include unprivileged LXC, per-user proxy accounts with fail2ban, AppArmor profiles, optional `AGENTBOX_ROOT` sandbox, KMS envelope encryption (Vault Transit, GCP KMS), tmpfs secret delivery, audit log with SHA-256 hash chain, image-digest verification, registry allowlists, and ClamAV/Trivy scanning. The sentinel detects spot preemption in ~10s, serves a maintenance page, and auto-recovers in ~85s while holding a static IP. Quickstart: `curl -fsSL https://containarium.dev/install.sh | sudo bash` installs daemon + Incus on Ubuntu; `containarium create alice --ssh-key ~/.ssh/id_ed25519.pub` creates a box; `containarium ssh-config sync` wires SSH; add MCP config pointing to `ssh alice agent-box`; `containarium expose-port alice --container-port 8080 --domain blog.example.com` publishes a public HTTPS endpoint. A single `containarium quickstart alice --prompt "..." --domain ...` collapses all steps. Licensed Apache 2.0, no CLA.