Isolated & disposable
One LXC box per agent or per task, sandboxed from the host and other tenants. Delete it when the run is done — no residue on your machine.
Code an agent writes is code you didn't review. Run it in a disposable Linux box — isolated from your machine and every other tenant — instead of on your laptop or a shared host. Self-host it so the code never leaves your network.
# spin up a throwaway box, run the generated code inside it
$ containarium create run-box
✓ isolated box run-box ready
$ containarium ssh run-box -- 'python /tmp/agent_output.py'
…runs in isolation, not on your machine…
$ containarium delete run-box # gone, no traceWhy isolate it
An agent can write a script that deletes the wrong directory, exfiltrates a secret, or pulls a malicious dependency. On your machine that's a real incident. In a Containarium box it's contained.
One LXC box per agent or per task, sandboxed from the host and other tenants. Delete it when the run is done — no residue on your machine.
Optional eBPF per-tenant policy blocks egress except a CIDR/domain allowlist, so generated code can't quietly call home or reach the rest of your network.
Self-host on your own VM and the code, data, and artifacts never leave your network — no shipping untrusted code to a third-party cloud.
How it works
One command spins up an isolated Linux box with its own filesystem and network.
The agent executes generated code inside the box over MCP or SSH — and can inspect logs and iterate in place.
Keep the box as a persistent workspace, or delete it — the blast radius dies with it.
FAQ
Run it in an isolated, disposable box instead of on your machine. Containarium gives each agent its own LXC container, sandboxed from the host and other tenants, with optional eBPF deny-by-default network controls. Execute there, then tear it down.
Not on a laptop or shared host — one isolated box per agent or task, so a bad install or destructive command is contained. Containarium provisions that box in one command and exposes it over MCP.
Yes — the core is open source (Apache 2.0) and runs on your own VM, so code and data stay in your network. A hosted option exists if you'd rather not run the infrastructure.
Serverless sandboxes reset between calls. A Containarium box is a persistent full Linux environment with root and a routable hostname — install tools once, keep caches warm, host what it builds — while still isolated and disposable when you want. See the sandbox comparison.
Start free on the hosted cloud, or self-host the open source on your VM.