A real Linux box, in one command.

The open-source agent runtime with SSH-native isolation. Each agent gets a persistent, network-isolated box on Kubernetes or LXC — no kube-apiserver token, eBPF egress policy, MCP server built in. Self-hostable, Apache 2.0.

for AI agents for CI runs for PR previews · planned

Try Containarium Cloud v1.0 Get the open-source CLI v0.x

Self-host on your own VM, or skip the ops and run it on our hosted control plane.

Containarium demo: install in one command, create a box, then drive it with an AI agent that SSHes in, installs Caddy, and exposes the app on a public HTTPS domain. — Install in one command, then hand the box to your agent.

Install on a fresh Ubuntu VM

curl -fsSL https://containarium.dev/install.sh | sudo bash

What is Containarium

A primitive, not another agent.

Every agent needs an environment to act in — somewhere safe to run code, edit files, and call tools. Containarium is that environment. You bring the agent. We give it the box.

Isolated box — LXC or Kubernetes

One Linux box per agent, on LXC or a K8s pod. Real root, real filesystem, eBPF egress policy — sandboxed from your host, cluster control plane, and every other tenant.

Exposed on a hostname

A built-in sentinel (sshpiper + Caddy + PROXY protocol) gives every box a routable hostname with TLS. SSH and HTTP just work.

MCP server inside

An MCP server runs in the box, exposing shell + file ops over stdio. Any MCP-aware agent drives it: Claude Code, Cursor, Cline, your own.

How it works

From agent to box, in one hop.

STEP 1

Create a box

containarium create spins up an LXC container and registers a route on the sentinel.
STEP 2

Point your agent at it

The box exposes an MCP server. Your agent connects over SSH or HTTPS — by hostname.
STEP 3

Let it work

The agent edits files, runs commands, and ships code — inside an isolated environment you control.

Built for

Anywhere an agent shouldn't run on your laptop.

Long-running coding agents

Give Claude Code or Cursor a persistent box — survives across sessions, ships from anywhere.

CI & ephemeral envs

Spin a box per PR, run the agent inside it, throw it away. No more racing the runner.

Agent fleets

One box per task, per user, per tenant. The sentinel handles routing; you handle the agent.

Custom MCP tools

Drop your own MCP server beside the built-in one. Every agent sees both, no plumbing.

For CI

A test runner you can SSH into when it fails.

GitHub-hosted runners are a black box that dies the moment your test fails. Containarium gives every CI job a real Linux box with warm caches across runs — and keeps it alive for an hour on failure so a human (or an agent) can debug the broken state in place.

.github/workflows/test.yml

name: CI
on: [pull_request]
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: footprintai/containarium-run@v1
        with:
          api-url: ${{ secrets.CONTAINARIUM_API_URL }}
          token:   ${{ secrets.CONTAINARIUM_TOKEN }}
          cache-key: ${{ hashFiles('go.sum') }}

.github/containarium.yml

# Three fields. Resist adding a fourth.
image: ubuntu-24.04

setup:                   # cached by cache-key
  - apt-get install -y build-essential
  - go mod download

test:                    # the actual CI command
  - go test ./...

When a test fails, keep-on-failure: true posts this on your PR:

containarium-bot commented just now

❌ CI failed — box kept alive for debugging

Failing test: TestExposePort_TLSHandshake in internal/server/expose_test.go:142

Debug this box live (expires in 58 minutes · extend 1h · tear down now)

# SSH in
ssh -p 2222 [email protected]

# Or hand it to your agent (Claude Code, Cursor, ...)
claude mcp add containarium-debug \
  https://mcp.containarium.dev/box/pr-1234-abc?token=ey...

🤖 Posted by containarium-run · commit a7b2f93

Three ways to wire CI into Containarium

GitHub Actions is one common surface — and Containarium supports it at three increasingly self-contained tiers. The capability (per-job ephemeral Linux box) is the same across all of them; what differs is where the code actually runs.

Tier	Best for	Setup	Where code runs
0 · Try it ~5 min setup	Evaluators, hobby OSS	Sign up to hosted cloud · use `containarium-run` Action	Code → GHA-hosted → cloud.containarium.dev → Containarium box
1 · Mid-market ~30 min setup	Teams with own infra	Self-host Containarium OSS · `hacks/runner/` for N ephemeral runners	Code → GHA-hosted (orchestration only) → your runner pool
2 · Enterprise audited / SSO	"Code can't leave our perimeter"	Tier 1 + audit log + SSO + data-residency docs	Nothing crosses to FootprintAI infra
3 · Air-gapped offline bundle	Regulated industries	Tier 2 + offline install bundle + private Git server	Fully contained in customer VPC

Tier 0 is the fastest evaluation path. Tier 1+ keeps source code, tests, and build artifacts inside your network. Same Containarium primitive underneath all four.

Get the GitHub Action (Tier 0) Runner kit for self-host (Tier 1+)

For PR previews

Planned — not shipping yet

The plan: every pull request gets a live URL.

The design below is on the roadmap, not in the product. We are describing it because it is where the CI runner is heading — and we would rather show the direction than imply it already works.

What ships today is the layer underneath: a CI runner that reads .github/containarium.yml, runs your tests in a box, and can keep that box alive for debugging after a failure. See “for CI runs”.

ON OPEN

Spin a box from the branch

Read .github/containarium.yml, run setup: + serve:.

ON PUSH

Rebuild in place

Same box, warm cache, one comment edited in place rather than a new one per push.

ON CLOSE

Tear it down

Box deleted, subdomain freed, with idle previews suspended before that.

Follow the work on GitHub

Enterprise · Bring your own cloud

VMware for your cloud VMs.

VMware turned each server into many isolated VMs. Containarium turns each cloud VM into many isolated containers — consolidated, governed, and benchmarked, running in your own cloud account. The same model, one layer up the stack.

VMware

Containarium

Runs on your bare-metal servers: Runs on your cloud VMs
1 server → many isolated VMs: 1 VM → many isolated containers
vCenter manages the fleet: One control plane: RBAC, audit, DNS, backups
Isolation via the hypervisor: Isolation via containers + QoS — no hypervisor tax
Lives in your datacenter: Lives in your cloud account

Consolidate the sprawl

Pack many isolated services onto the VMs you already run — instead of one instance per workload. Fewer, denser machines, each container walled off with eBPF egress policy and QoS.

Governed & sovereign

RBAC, audit log, SSO, security scanning and backups — over infrastructure that never leaves your account or your boundary. Built for data residency and compliance.

Native home for AI agents

The same isolation makes a fleet of agents safe: one SSH-accessible box each, every action audited, all on your own cloud. Sovereign AI, with no integration to build.

Talk to sales about BYOC Explore Enterprise & BYOC →

Choose your flavor

Open source, or fully hosted.

Same primitive. You decide who runs it.

Containarium OSS

Apache 2.0

The CLI, the platform daemon, the sentinel, the agent-box MCP server. Self-host on one VM. Single-tenant, but yours forever.

Full CLI: create / list / route / expose-port
Bring-your-own-agent over MCP — Claude Code, Cursor, Cline, custom
Sentinel: hostnames, TLS, SSH routing
Local web UI for managing your boxes
No CLA. PRs welcome.

View on GitHub v0.x

Recommended

Containarium Cloud

Hosted

The same primitive, run for you. Multi-tenant, billed by the hour, with SSO, audit logs, and a polished control plane.

Everything in OSS, no infra to run
Multi-tenant orgs · roles · SSO (SAML / OIDC)
Hosted dashboard · audit log · metering
Hybrid pricing: per-container base + usage overage
Free tier · upgrade when you grow

Open Containarium Cloud v1.0

Already on GCE or EC2?

Give your cloud a free health check.

A read-only Telescope scan classifies every instance in your fleet by real utilization — know where you are before you change anything. One client's check-up led to 20% off the bill; if yours shows waste, we size the consolidation plan.

Run the health check

Give your agent a real box.

Start with Cloud Read the OSS source