Self-hosted · Linux or macOS · Claude Code, Codex, Cursor, OpenCode, Devin, pi, fx, Kimi CLI, GitHub Copilot, Mistral Vibe, Grok Build, Gemini CLI and Qwen Code
Each session gets its own Docker container with a full Linux desktop, and the agent works in it like a person would: terminal, editor, browser, mouse and keyboard. You watch the screen live, browse and edit the files, open terminals, and step in when you want to.
curl -fsSL https://sessionboxer.talayolabs.com/install.sh | sh
Needs Docker
(how to install it on macOS, Windows or Linux). Or brew install talayolabs/tap/sessionboxer,
npx sessionboxer serve, docker compose up or a desktop app — see
Install.
The container is the safety boundary. Everything the agent does happens in there, and everything you need to follow it is in one browser tab.
A prompt box with the agent, the repositories and Start under it. Click your agent's logo for the three commands that connect it on your OS; GitHub or Bitbucket is one more click. The rest of a session's settings sit behind Advanced….
Every conversation runs in its own container with its own copy of the code. Nothing the agent does touches your machine; delete the session and it is all gone. Each agent has its own Sandbox image, pulled the first time you use it; a fork into another agent gets that agent added to its box.
Pick the environment under the prompt: Docker · Linux, QEMU · Windows or QEMU · macOS. For the last two a VM boots next to the box and the agent runs inside it, with its repositories, terminal and MCP servers; you watch and take over the Windows or Mac desktop from the same pane.
The container runs a Linux desktop with Firefox. The agent can take screenshots, click, type and drag (the cursor glides to its target like a hand would), so it can test web apps, read documentation or use any GUI tool. You see the same screen in the browser and can take the controls at any time.
Inside the box the agent runs with all permissions granted, so it doesn't stop every few seconds to ask whether it may run a command. The container is the safety boundary.
Full VS Code running inside the box (with its AI features switched off: the agent in the chat is the one you talk to), and as many shells as you want. Files named in the chat open in the editor at that line.
A gauge under the prompt box shows how full the agent's context window is (green to red, rotting past half), how many times the conversation was compacted, and what each turn cost; a Context pane breaks the window down by system prompt, tools, MCP servers, memory files and messages.
Ask for a screen recording of a feature and the agent records the box's desktop to an .mp4 you can play right there, with captions it wrote as it worked and, optionally, narration spoken by a local text-to-speech model. Images, SVGs, PDFs and Markdown with Mermaid diagrams show up the same way. Recordings run at 30 fps with a drawn pointer that moves at a hand's pace.
Take a snapshot of the box after any turn (or after every one). Fork a new session from it and choose what the fork does with the conversation: continue it, start a new one on the same files, or hand off — the first agent writes a handoff and another agent (Claude Code → Codex, say) picks up from it. Revert the chat to an earlier turn and what followed stays as a branch.
Paste a GitHub or Bitbucket Data Center PR URL, or let the agent open one, and it is watched: a table of comments, review threads and reviews, the checks on the head commit (failed / running / passed, a notification when one fails), and buttons to turn any item into a prompt, have the agent address it, or fix and push. Auto-merge merges when the checks pass and says what it is waiting for (an approval, say) while they don't.
For Claude Code sessions, a recorder in the box keeps every request to the Anthropic API and its
response, byte for byte. Each bubble gets an LLM #n label that opens the request,
the response, a parsed tree and a diff against the previous call.
Add MCP servers in Global settings (a command to run in the box or an HTTP URL, secrets write-only), switch them per session, toggle them mid-conversation. GitHub's own MCP server connects with one click through the GitHub CLI's login, and the box is logged in as that account too.
A built-in sessionboxer MCP server tells the agent which session it runs in and
answers questions from the guide. If you allow it, the agent attaches pull requests, takes
snapshots, opens a Terminal for you, or creates and messages other sessions — each action marked
in the chat, creation behind an Allow / Deny card. Every tool of the desktop and
sessionboxer servers: MCP tools reference.
Plug a phone, a board or a dongle into the machine and hand it to one session from the header
menu. The agent gets that device and nothing else on the bus, follows it through resets and
Android's debugging prompt, and can adb install the build it just made.
Stop a session to free CPU and memory; resume it later with the conversation, files and installed tools exactly where they were.
Optional. Agents can run docker, docker compose and
docker build inside their own container, unprivileged when Sysbox is installed on
the host.
Start from one or several git URLs (each with its own GitHub account, if you have more than one), an empty directory or a copy of a folder on your machine, and pull the agent's changes back with a preview of what would change. Sessionboxer uses your own Claude, ChatGPT, Cursor, Devin, OpenCode, pi, fx, Kimi CLI, GitHub Copilot, Mistral Vibe, Grok Build, Gemini CLI or Qwen Code account; there is no Sessionboxer account and nothing leaves your machine except the agent's own traffic.
Attach files by dropping or pasting them; they are uploaded into the box and handed to the model
when it accepts them. Enqueue the next request while the agent works and it goes out as
soon as the agent is free (pause the queue if you'd rather not). Dictate a prompt with the mic:
whisper.cpp runs offline on your machine. A command line (sessionboxer new .) boxes
the current directory.
A camera button takes a photo, films a video or records your screen for the prompt; a pencil opens a sketch sheet.
Behind Cloudflare WARP, Zscaler or another TLS-inspecting proxy, the CA certificates your machine trusts beyond the public ones are copied into every box, so HTTPS from the agent, MCP servers and the image build works like from your machine. Point Claude Code at your company's Claude proxy from Global settings.
A trigger, an action and limits. A prompt on a cron timetable into a running session or a fresh one that stops when done; or, when a pull request you follow opens, changes or fails a check, a review posted under your login, an Auto QA video on the PR, or a prompt to the session that has it; or an event from one of your MCP servers (an email, a ticket, an incident). Runs and outcomes are listed with the automation.
Follow a repository's open PRs, the ones you opened or the reviews asked of you, without a session: comments, reviews and checks with their output in one page, attach a PR to a session or start one on its head. Polled every minute; a webhook makes it immediate.
Register New Relic, Grafana, a QA web app, RabbitMQ, a database or an SSH host once, per environment, with its credentials. Switch them on per session and the agent uses them by name: passwords and one-time codes are filled in on the way to the screen, never shown to it, never in the chat or a snapshot. Procedures are skills about investigating with them.
An HTML file the agent writes runs inline as a sandboxed app, and the App pane reloads it as the agent edits. Tools of your MCP servers that carry a view (MCP Apps, MCP-UI) render it under the tool call, with the exact result, in the same sandbox.
Group sessions by project in the sidebar: drag a session onto a folder, right-click for Pin, Move to folder, Snapshots, Fork, Stop and Delete. Pinned sessions stay at the top; the layout is the same in every browser.
The agent's messages of a turn fold into one line — a spinner, the message count and the time it has been at it — and only its summary stays when the turn ends; open the fold to see every step, thought and screenshot as it happened. Each message carries its time (12 min ago, the exact date on hover).
After each turn, the agent plans a few end-to-end test cases for what it just did, runs them on the desktop with mouse, keyboard and browser, fixes what fails and records a captioned video of it. The Verification pane shows each case, its state and the video, and Run now starts a run whenever you like. On by default; switch it off per session or globally.
Three small bars above the context gauge show how much of your plan's windows are used (Claude's session, week and Opus windows; Codex's 5-hour and weekly limits), with the reset time on hover. When the agent refuses a turn for lack of credit, a no-entry bar counts down to the reset; Continue resends the prompt, Auto-continue does it for you as soon as credit is back.
Eleven light and dark themes (Sessionboxer, GitHub, Catppuccin, Solarized, Dracula, Nord, One Dark), or follow the system with a light and a dark pick. The whole UI follows — chat, terminal, diagrams — and the VS Code in the box switches to the same palette live.
Each card opens a page with screenshots, things you can do with the feature and how other products compare. All features →
One process listens on your machine. Each session is a container it talks to over a private Docker network; nothing in a box is published to the host.
127.0.0.1:4000
sessionboxer Docker network · no published ports
claude-agent-acp or devin acp, all permissions granted/workspace, seeded from a git URL or your foldercomputer toolset.
docker commits
and a fork is a new Sandbox created from one of them.
All thirteen run inside the box over ACP, with the same desktop tools. You bring your own account; tokens are handed only to the containers of sessions that use that agent and are never stored in snapshots. A fork can switch agent mid-way through a handoff.
Through claude-agent-acp, with your Claude subscription: run
claude setup-token and paste the result in Global settings.
LLM #n.
Through codex-acp, with your ChatGPT subscription: run codex login on
your machine and paste ~/.codex/auth.json in Global settings. It lives on tmpfs in the
box; refreshed tokens are stored back.
Through the Cursor CLI's own agent acp, with your Cursor subscription: run
agent login on your machine and paste or import the auth.json it writes in
Global settings (an API key from the Cursor dashboard works too). It lives on tmpfs in the box;
refreshed tokens are stored back.
Through the Devin CLI's devin acp, with your Devin account: run
devin auth login and paste the token from its credentials file in Global settings.
Through its own opencode acp, with the login of opencode auth login on your
machine: paste ~/.local/share/opencode/auth.json (Anthropic, OpenAI, OpenCode Zen, …) or an
OpenCode Zen API key in Global settings. It lives on tmpfs in the box; refreshed tokens are stored back.
desktop and sessionboxer MCP servers and yours, handed over ACP.
Through the pi-acp adapter, with the auth.json pi's /login writes
and/or your model providers' API keys as NAME=value lines, pasted in Global settings. Kept
on tmpfs, in the pi process only.
mcp.json.
Through fx acp, with your fx login file (a Vercel, Codex or Grok login) or an AI
Gateway API key pasted in Global settings. Kept in a per-session volume that snapshots never see.
Through kimi acp, with the file kimi login writes or Sign in with Kimi CLI
(a device code). Kept on tmpfs in the box; refreshed tokens are stored back.
Through copilot --acp, with Sign in with GitHub Copilot (the device flow), the
file copilot login writes or a GitHub token with the Copilot Requests permission.
COPILOT_GITHUB_TOKEN, the MCP servers through its own mcp-config.json.
Through vibe-acp, with Sign in with Mistral Vibe (console.mistral.ai) or a Mistral
API key. The box keeps it in memory only, as Vibe's .env.
xAI's own coding agent, through grok agent stdio, with the file grok login writes,
Sign in with Grok Build (a device code) or an xAI API key.
fx login grok: that one puts a Grok subscription behind Vercel's agent.
Through gemini --acp, with your Google login (~/.gemini/oauth_creds.json) or a Gemini
API key pasted in Global settings. Refreshed tokens are stored back.
Through qwen --acp, with your Qwen login (~/.qwen/oauth_creds.json, free tier) or any
OpenAI-compatible endpoint (OPENAI_API_KEY, OPENAI_MODEL, OPENAI_BASE_URL).
Hosted agents give you a machine in their cloud on their account. Sessionboxer gives the same kind of machine on yours, with the agent and subscription you already have.
| Sessionboxer | Devin | Cursor Cloud Agents | Codex cloud | Claude Code on the web | OpenHands | T3 Code | |
|---|---|---|---|---|---|---|---|
| Runs on your machine or your server | ✓ | ✗ | ✗ | ✗ | ✗ | ✓ | ✓ |
| Your existing subscription, no new account | ✓ | ✗ | ✗ | ✗ | ✗ | API key | ✓ |
| Agents | Claude Code Codex Cursor OpenCode Devin pi fx Kimi CLI GitHub Copilot Mistral Vibe Grok Build Gemini CLI Qwen Code | Devin | Cursor | Codex | Claude Code | own agent, any model | Claude Code, Codex, Cursor, others |
| Isolated sandbox per session | Docker, / VM | VM | VM | container | VM | Docker | ✗ (your machine) |
| Desktop the agent drives with mouse and keyboard | ✓ | browser | ✓ | — | — | browser | ✗ |
| Watch the screen live and take over | ✓ | ✓ | ✓ | — | — | — | ✗ |
| VS Code and terminals inside the sandbox | ✓ | ✓ | — | — | — | — | your own |
| Several repositories in one session | ✓ | ✓ | ✓ | — | — | — | — |
| Snapshot and fork the whole machine | ✓ | — | — | — | — | — | ✗ |
| Revert the conversation, branches | ✓ | — | — | — | — | — | — |
| Pull requests: follow, address, auto-merge | ✓ | follow, address | address | address | address | address | ✗ |
| See the exact model API calls | ✓ | — | — | — | — | — | — |
| Offline dictation | ✓ | — | — | — | — | — | — |
| Phone | PWA + push | web | iOS app | ChatGPT app | Claude app | web | iOS, Android |
| Open source | MIT | ✗ | ✗ | ✗ | ✗ | MIT | MIT |
From each product's public documentation, September 2026; ✓ = offered, ✗ = not offered, — = not found in the docs. Corrections welcome as an issue.
Sessionboxer listens on 127.0.0.1:4000 and every browser logs in once with the access
token or a pairing code. Pair another device in Global settings shows a QR code and picks how the
phone reaches this machine: the local network, a Cloudflare quick tunnel, the Sessionboxer tunnel
(a stable https://<name>.tunnel-sessionboxer.talayolabs.com address) or your own
server over SSH.
The phone gets the same session in a one-column layout with a touch desktop, and push notifications when the agent finishes or a pull request gets a comment. Paired devices are listed in Global settings and can be revoked there.
Every session is a Docker container, so the machine that runs Sessionboxer needs a Docker engine with
the docker compose plugin. All three installs below include it. When
docker compose version answers, come back to Get started.
brew install --cask orbstack
open -a OrbStack # finish its setup once
docker compose version
OrbStack is lighter and reaches the boxes
by their own address, like Linux does; on Apple silicon it may ask to install Rosetta, say yes.
Docker Desktop for Mac
(brew install --cask docker) works too. Either one needs a Mac that can run virtual
machines, so not a Mac that is itself a VM. Open the app once and wait until it says it is running,
then install Sessionboxer.
wsl --install # reboot when it asks
winget install -e --id Docker.DockerDesktop
wsl -e docker compose version
WSL2 gives Windows a
Linux kernel;
Docker Desktop for Windows
runs the engine on it. In Docker Desktop, keep Use the WSL 2 based engine on and turn on
WSL integration for your
distribution. Then open a WSL terminal (wsl) and run the Sessionboxer commands from
Get started in it: the one-liner is a shell script and Sessionboxer itself
runs on Linux, so on Windows it lives inside WSL.
curl -fsSL https://get.docker.com | sh
sudo usermod -aG docker $USER # then log out and in
docker compose version
get.docker.com installs Docker Engine, the
docker compose plugin and Buildx from Docker's repositories on every common
distribution; the
per-distribution instructions
do the same by hand. The usermod line lets your user talk to the daemon without
sudo, which Sessionboxer needs (post-install steps).
Already have Docker? docker info has to work as your user, and docker compose version
has to print a 2.x version: the old standalone docker-compose (1.x, with a dash) is not
enough. Colima works with DOCKER_HOST=unix://$HOME/.colima/default/docker.sock; the
macOS notes in the guide have the details.
Run the one-liner above (it picks npm or Docker Compose), or one of the commands below. Start the
server and open the login link it prints: http://127.0.0.1:4000/#pair=… logs your
browser in once. Sessionboxer only listens on localhost.
The Sandbox image (ghcr.io/talayolabs/sessionboxer-sandbox, a few GB, amd64 and
arm64) is pulled the first time the server starts.
On the first screen, click the logo of the agent you subscribe to:
Claude Code,
Codex,
Cursor,
OpenCode,
Devin,
pi,
fx,
Kimi CLI,
GitHub Copilot,
Mistral Vibe,
Grok Build,
Gemini CLI or
Qwen Code. The dialog
shows the three steps for your OS (install the CLI, run claude setup-token or
codex login or the like, paste the result). Add GitHub or Bitbucket if the code is
private, type the first prompt, Start.
How the first screen works →
brew install talayolabs/tap/sessionboxer
sessionboxer serve
Installs the release with Homebrew's Node, no npm to think about; brew upgrade
updates it. The same package has the sessionboxer new . command line. Port 4000 taken?
SESSIONBOXER_PORT=4001 sessionboxer serve.
the tap
npx sessionboxer serve
Or npm i -g sessionboxer once and sessionboxer serve. Port 4000 taken?
SESSIONBOXER_PORT=4001 sessionboxer serve.
sessionboxer on npm
curl -fsSLO https://raw.githubusercontent.com/talayolabs/sessionboxer/v1.8.0/docker-compose.yml
docker compose up -d
docker compose logs control-plane # the login link (-d hid it)
docker compose exec control-plane sessionboxer token # the token, for other browsers
The Control Plane runs from ghcr.io/talayolabs/sessionboxer with the Docker socket
mounted, so sessions are sibling containers. That socket is root on the host: run it on a machine
you would trust the agent's boxes with anyway. .env sets the port, bind address, public
URL and a fixed token.
An app that starts the Control Plane and stays in the tray. Needs Docker like the others. Version 1.8.0:
Not code-signed yet: macOS says the download is “damaged” until you clear its quarantine flag (command under Remote access), Windows needs More info → Run anyway. All files of the release
git clone https://github.com/talayolabs/sessionboxer.git
cd sessionboxer && npm install && npm run build
npm start # pulls the Sandbox image…
npm run build:image # …or build it here (~5 GB)Every version is a GitHub Release with notes and the npm tarball; images on GHCR: sessionboxer and sessionboxer-sandbox (linux/amd64, linux/arm64). MIT licence.
Installed? The first run takes you through connecting Claude, Codex, Cursor, OpenCode, Devin, pi, fx, Kimi CLI, GitHub Copilot, Mistral Vibe, Grok Build, Gemini CLI or Qwen Code; the user guide covers the rest, one page per topic.
Plain-English posts on running coding agents in boxes, with the news of the week and how the other products do it.
An AI security agent left a researcher's sandbox and pulled customer data from a WorkOS tool. What WorkOS found, and how to limit what your agents can reach.
Kimi CLI is archived and Kimi Code CLI replaces it. How to put the new CLI in a container, log in or pass a key without a prompt, and pick a safe mode.
Manifold's agentaudit lists the hooks, PATH changes, MCP servers and proxies a repository's agent config sets up. How to run it, and what to do next.