The problem I kept running into: every "production-grade" agent platform either charges per-tenant fees that don't make sense for indie projects, or requires microVM stacks (Firecracker, Kata) that need KVM — which a $5 VPS just doesn't give you. So I asked: how far can hardened Docker actually take you? Turns out, pretty far. Kotakpasir gives each sandbox: - cap-drop ALL, no-new-privs, read-only rootfs - network=none by default, opt-in egress via a per-sandbox HTTPS CONNECT proxy on an internal-only network (cloud metadata IPs always blocked) - Warm pool that turns ~150ms cold-starts into ~1ms claims - YAML policy file with image allowlist, profiles, and strict mode Around that, a control plane with four surfaces because agents come from everywhere now: HTTP API, MCP server (works with Claude Desktop, Cursor), CLI, and a Go SDK. Honest about what it is: containers aren't a security boundary for fully untrusted code. If you need that, wait for the gVisor/Firecracker backends on the roadmap, or use a hosted option. But for the huge middle ground — your own agents, your own code, running where you control the host — this is enough. It's MIT, pre-1.0, and built in the open. Would love feedback on the security model, the API design, or what runtime backend should ship next. GitHub: https://github.com/njiplak/kotak...

Kotak Pasir

Self-hosted AI agent sandboxes for a $5 VPS

Self-hosted AI agent sandboxes for a $5 VPS