hello humans of PH :) i wanna share this open source project (apache 2.0) that i've been working on for the past 2 ish months or so. it's called hotcell and it lets you create/pause/manage sandboxes on any device (your laptop, linux vm, bare metal).
i've tested it against various benchmarks that i found on computesdk (https://www.computesdk.com/bench...) as well as the one shared by dax (cofounder of open code) on twitter recently (link to his original thread and my reply https://x.com/sinasanm/status/20...)
and generally the full benchmark results are here: https://github.com/sinameraji/ho......
i spent a lot of time on making sure both the devrloper experience and agent experience are smooth on it and im actively working to make it perform better against benchmarks.
also api keys are never directly injected into the sandbox. instead it creates a per-sandbox token that becomes useless when the sandbox dies.
as for isolation method, it can work with docker, apple VZ (vm grade isolation on mac) or firecracker for linux .
primary use cases i imagine:
* if you build agentic desktop apps that have filesystem access locally, hotcell makes it super easy to start a sandbox and bring whatever file needed to it, do the work in a new branch, create a PR and close the sandbox
* if u just use claude code etc. and wanna spin up 5-6 diff environments without using worktree or cloning your project dirs, u can write a 1 line command like this to instantly have 5 sandboxes! hotcell create -n 5 --name feat --branch auto --opencode --repo https://github.com/you/app
my inspiration was cloudflare sandbox sdk (but i noticed my friends and i couldn't use cloudflare in on-prem environment so i thought i'd build a local / open source one that works w any hardwarw).
thank you and hope you like it.
PH 用户
What's the isolation model - containers, lightweight VMs, or something custom? Curious how heavy it feels on a laptop running a coding agent alongside the sandbox.
PH 用户
the per-sandbox scoped tokens that die with the sandbox is honestly such a clean move, keeps api keys out of the blast radius without making the workflow annoying
PH 用户
Sandboxing agents locally makes a lot of sense to me. How much does the isolation cost you in practice on a Mac? Curious whether it's noticeable or whether it disappears into the noise.
i've tested it against various benchmarks that i found on computesdk (https://www.computesdk.com/bench...) as well as the one shared by dax (cofounder of open code) on twitter recently (link to his original thread and my reply https://x.com/sinasanm/status/20...)
and generally the full benchmark results are here: https://github.com/sinameraji/ho......
i spent a lot of time on making sure both the devrloper experience and agent experience are smooth on it and im actively working to make it perform better against benchmarks.
also api keys are never directly injected into the sandbox. instead it creates a per-sandbox token that becomes useless when the sandbox dies.
as for isolation method, it can work with docker, apple VZ (vm grade isolation on mac) or firecracker for linux .
primary use cases i imagine:
* if you build agentic desktop apps that have filesystem access locally, hotcell makes it super easy to start a sandbox and bring whatever file needed to it, do the work in a new branch, create a PR and close the sandbox
* if u just use claude code etc. and wanna spin up 5-6 diff environments without using worktree or cloning your project dirs, u can write a 1 line command like this to instantly have 5 sandboxes! hotcell create -n 5 --name feat --branch auto --opencode --repo https://github.com/you/app
my inspiration was cloudflare sandbox sdk (but i noticed my friends and i couldn't use cloudflare in on-prem environment so i thought i'd build a local / open source one that works w any hardwarw).
thank you and hope you like it.