Building an Agent Sandbox

I've recently become obsessed with sandboxing agents. Over the last six months, late 2025 and early 2026, Simon Willison mentioned agent sandboxing and sandboxing in general in a variety of posts. In January, after Claude Code logged into my raspberry pi without asking to fix an issue and made it unbootable I decided something needed to be done. I decided in January to start working at solving it. I wanted a tool where I could run agents, see if they needed attention, and manage them on my phone (without getting vendor locked). I wanted to use LLMs of various trust levels (American, Chinese, self hosted) all in the same place to get work done and play with agents.

I built Agent Starbase to fix that issue, replacing my entire terminal coding experience with a web UI based flow.

You can quickly see what Missions (jobs) are running and if the agent has been idle you can quickly see what needs attention.

You can see the transcript of what the agent did and open files to see the changes.

You can check the Git diff with the Actions dropdown on the top left

Then I review the changes in my browser or at a coffee shop on my phone, and then have cheap AI models write a commit message and then push the code. I've become free from my laptop/chair and able to work on the go. Knowing 1 hour away from your computer won't slow down your agents gives a lot of relief. Life can be lived again! Now agents won't crash my production server or drop my production database because they have SSH access only a 3 second tool call away.

I want AI to do work but I like to verify what it did first, at least at the current capabilities. I don't want AI to be committing and pushing code. I don't want AI sending my API keys or sensitive data to attackers' servers. I don't want them SSHing anywhere! Putting them in a box makes me free to run them without approvals, and not worry that they will destroy something. I am responsible for what they do in the world!

There were challenges in building this I had to learn about (or delegate AI to learn about):

• network restrictions
• user permissions in docker
• browser based terminals
• websocket updates
• locking down git write/commit for agents
• locking down ssh access for agents

I used Squid proxy for network lock down, xterm.js for the browser terminal, ssh and git go through a separate helper container for separation from where agents work. Docker-in-Docker (DinD) was essential to set up so my agents could run tests and do things with the applications (like take screenshots of finished UI functionality). I built a task management board agents could use (inspired by Beads) so I could better understand what agents had worked on and so they could log issues or bugs they found while continuing on the task I assigned and not get distracted. When you have a full environment around the agents, you can set up tools like pings every 3 minutes to have an agent check on something, cron jobs that run overnight to not use up your 5 hour subscription windows, and logging/searching prompts and sessions so you can find something you did 5 weeks later.

I'm very proud of where this tool is and I use it for everything. I can't imagine life without it! There is still a long way to go, and I have a lot of ideas yet. I want to get browsers working seamlessly so agents and humans can share them to do important tasks on the internet. I want better filesystem permissions - allowing less trusted agents to access only what I choose of a project. I want multi-tenancy to work so multiple users can run on the same company or self-hosted server and use different subscriptions/tools and run separate git branches or worktrees. My plan is to release it in a few days on Github, so stay tuned.

Contact me if you have any questions, ideas, or want help with something AI related. Always happy to chat!