Isolated from your machine
A misbehaving install or command stays in the box — sandboxed from your host and every other tenant.
Give Claude Code its own isolated, persistent box — one it drives over MCP and SSH. Keep long-running agents off your laptop, keep state across sessions, and let them host what they build. Self-hostable, or run hosted.
# 1. create a box for the agent
$ containarium create my-agent-box
# 2. point Claude Code at the box's MCP server
$ claude mcp add my-agent-box https://my-agent-box.example.com
# …or wire up SSH and let it work over the shell
$ containarium ssh-config my-agent-box >> ~/.ssh/config
Claude Code now has its own box.Why a box
Claude Code installs packages, runs builds, and executes code you didn't write. Give it a box and that work is isolated, persistent, and yours to throw away.
A misbehaving install or command stays in the box — sandboxed from your host and every other tenant.
Tools, caches, and state survive between runs, so Claude Code resumes where it left off instead of starting cold.
Run several Claude Code sessions in parallel — a box each, routed by hostname, no interference.
Connecting
Each box runs an MCP server exposing shell + file operations. Add it with claude mcp add and Claude Code uses typed tools — no fragile TTY scraping.
Append containarium ssh-config to your SSH config and Claude Code works the box like any remote host — through the sentinel, by hostname.
Not on Claude Code? The same box drives Cursor, Cline, OpenCode, or your own agent — it's MCP-native.
FAQ
Create a Containarium box, then point Claude Code at the MCP server inside it (or add the box to your SSH config). Claude Code drives the box directly — runs commands, edits files, ships code — instead of working on your laptop.
A long-running agent installs packages and runs code you didn't review. In a box that's contained, not on your machine — plus you get a persistent environment and can run several agents in parallel, one box each.
Yes — a box is a long-lived LXC container, so installed tools, caches, and state survive until you delete it.
Yes — the core is open source (Apache 2.0) and runs on your own VM, so the agent's code and data stay in your network. A hosted option exists if you'd rather skip ops.
Start free on the hosted cloud, or self-host the open source on your VM.