Isolated box — LXC or Kubernetes
One Linux box per agent, on LXC or a K8s pod. Real root, real filesystem, eBPF egress policy — sandboxed from your host, cluster control plane, and every other tenant.
The open-source agent runtime with SSH-native isolation. Each agent gets a persistent, network-isolated box on Kubernetes or LXC — no kube-apiserver token, eBPF egress policy, MCP server built in. Self-hostable, Apache 2.0.
Self-host on your own VM, or skip the ops and run it on our hosted control plane.
$ containarium create my-agent-box
✓ container my-agent-box created
✓ sentinel route my-agent-box.example.com live
✓ MCP server listening inside the box
$ containarium ssh-config my-agent-box >> ~/.ssh/config
# Now point any agent at it — Claude Code, Cursor, Cline...
$ claude --mcp my-agent-box.example.com
Connected. Your agent has its own box.What is Containarium
Every agent needs an environment to act in — somewhere safe to run code, edit files, and call tools. Containarium is that environment. You bring the agent. We give it the box.
One Linux box per agent, on LXC or a K8s pod. Real root, real filesystem, eBPF egress policy — sandboxed from your host, cluster control plane, and every other tenant.
A built-in sentinel (sshpiper + Caddy + PROXY protocol) gives every box a routable hostname with TLS. SSH and HTTP just work.
An MCP server runs in the box, exposing shell + file ops over stdio. Any MCP-aware agent drives it: Claude Code, Cursor, Cline, your own.
How it works
containarium create spins up an LXC container and registers a route on the sentinel.
The box exposes an MCP server. Your agent connects over SSH or HTTPS — by hostname.
The agent edits files, runs commands, and ships code — inside an isolated environment you control.
Built for
Give Claude Code or Cursor a persistent box — survives across sessions, ships from anywhere.
Spin a box per PR, run the agent inside it, throw it away. No more racing the runner.
One box per task, per user, per tenant. The sentinel handles routing; you handle the agent.
Drop your own MCP server beside the built-in one. Every agent sees both, no plumbing.
For CI
GitHub-hosted runners are a black box that dies the moment your test fails. Containarium gives every CI job a real Linux box with warm caches across runs — and keeps it alive for an hour on failure so a human (or an agent) can debug the broken state in place.
name: CI
on: [pull_request]
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: footprintai/containarium-run@v1
with:
api-url: ${{ secrets.CONTAINARIUM_API_URL }}
token: ${{ secrets.CONTAINARIUM_TOKEN }}
cache-key: ${{ hashFiles('go.sum') }}# Three fields. Resist adding a fourth.
image: ubuntu-24.04
setup: # cached by cache-key
- apt-get install -y build-essential
- go mod download
test: # the actual CI command
- go test ./...
When a test fails, keep-on-failure: true posts this on your PR:
Failing test:
TestExposePort_TLSHandshake
in internal/server/expose_test.go:142
Debug this box live (expires in 58 minutes · extend 1h · tear down now)
# SSH in
ssh -p 2222 debug@pr-1234-containarium.boxes.containarium.dev
# Or hand it to your agent (Claude Code, Cursor, ...)
claude mcp add containarium-debug \
https://mcp.containarium.dev/box/pr-1234-abc?token=ey...🤖 Posted by containarium-run · commit a7b2f93
Three ways to wire CI into Containarium
GitHub Actions is one common surface — and Containarium supports it at three increasingly self-contained tiers. The capability (per-job ephemeral Linux box) is the same across all of them; what differs is where the code actually runs.
| Tier | Best for | Setup | Where code runs |
|---|---|---|---|
|
0 · Try it
~5 min setup
|
Evaluators, hobby OSS | Sign up to hosted cloud · use containarium-run Action |
Code → GHA-hosted → cloud.containarium.dev → Containarium box |
|
1 · Mid-market
~30 min setup
|
Teams with own infra | Self-host Containarium OSS · hacks/runner/ for N ephemeral runners |
Code → GHA-hosted (orchestration only) → your runner pool |
|
2 · Enterprise
audited / SSO
|
"Code can't leave our perimeter" | Tier 1 + audit log + SSO + data-residency docs | Nothing crosses to FootprintAI infra |
|
3 · Air-gapped
offline bundle
|
Regulated industries | Tier 2 + offline install bundle + private Git server | Fully contained in customer VPC |
Tier 0 is the fastest evaluation path. Tier 1+ keeps source code, tests, and build artifacts inside your network. Same Containarium primitive underneath all four.
For PR previews
Open a PR → Containarium spins a box from the branch, serves your app on a real HTTPS subdomain, and posts the URL as a sticky comment. Push more commits → 8-second redeploys against a warm cache. Close the PR → the box disappears.
App reads .github/containarium.yml, runs setup: + serve:.
Same box, warm cache. Sticky comment updates with the new commit SHA.
Box deleted. Subdomain freed. Idle previews auto-suspend after 24h of no commits.
One sticky comment per PR — edited in place on every push, never spammed:
https://pr-1234-containarium.preview.containarium.dev
Built from commit a7b2f93 in 8.2s
(cache hit on go.sum).
This comment updates on every push. The box and URL are torn down when the PR closes. View logs · Rebuild
Choose your flavor
Same primitive. You decide who runs it.
The CLI, the platform daemon, the sentinel, the agent-box MCP server. Self-host on one VM. Single-tenant, but yours forever.
create / list / route / expose-portThe same primitive, run for you. Multi-tenant, billed by the hour, with SSO, audit logs, and a polished control plane.
Sign up to the hosted cloud, or clone the OSS and run it on your VM tonight.