---
title: "AI Sandbox"
description: "Federated CoreDesktop installs opencode, Hermes Agent, Cline Desktop and Claude Code, and runs them in a sandbox that keeps them out of your keys, passwords and other files."
sections:
  - type: hero
    compact: true
    eyebrow: "opencode · Hermes Agent · Cline Desktop · Claude Code"
    title: "AI agents that can't wander off."
    subhead: "CoreDesktop installs four AI coding agents and runs them in a sandbox. They can change your project, and not much else."
    ctas:
      - label: "Sign in your agents"
        url: "/utilities/#configure"
        style: primary
      - label: "Sandbox rules"
        url: "https://gitea.federated.computer/Federated_Computer/coredesktop/src/branch/main/sandbox/config"
        style: ghost
    logTitle: "~/Projects/site $ opencode"
    log:
      - tag: "Sandbox"
        text: "Write access: ~/Projects/site only"
      - tag: "Read"
        text: "Reading content/_index.md and hugo.toml"
      - tag: "Write"
        text: "Edited layouts/partials/header.html"
      - think: true
        tag: "Agent"
        text: "Trying to read ~/.ssh/id_ed25519"
      - tag: "Blocked"
        text: "~/.ssh is hidden from the sandbox"
      - tag: "Net"
        text: "github.com, npm and PyPI: allowed"
      - tag: "Blocked"
        text: "pastebin.example: not on the allow list"
      - done: true
        text: "Done. 1 file changed, nothing else touched."

  - type: split
    kicker: "In the sandbox"
    headline: "What an agent can and can't do."
    columns:
      - title: "It can"
        items:
          - "Change files only in the directory you start it from, plus its own settings and a few package caches. So start it from a project directory."
          - "Reach AI providers and common developer sites: GitHub, Gitea, npm, PyPI, crates.io, RubyGems, the Go module proxy and archlinux.org."
      - title: "It can't"
        items:
          - "Read your SSH keys, password stores or browser profiles"
          - "Read Flatpak apps' data: browsers, Signal, Telegram and the rest"
          - "Read your Nextcloud password, cloud and Git credentials"
          - "Read the other agents' logins"

  - type: cards
    kicker: "The agents"
    headline: "Four agents, one sandbox."
    columns: 2
    items:
      - label: "opencode"
        title: "Sandboxed when you type it"
        body: "Typing `opencode` runs it in the sandbox. To run it without, type `unsandboxed opencode`."
      - label: "Hermes Agent"
        title: "Talk to it over Matrix"
        body: "`hermes` or `hermes-agent` runs in the sandbox, and so does its gateway, which lets you talk to Hermes through Matrix and other messaging apps. Its sandbox allows local sockets but hides your D-Bus session, SSH agent, Docker, Tailscale, X11, tmux and browsers."
      - label: "Cline Desktop"
        title: "Your projects in ~/Projects"
        body: "Opened from the app menu. It can change files in `~/Projects`, open projects elsewhere only to read them, and reach cline.bot. It draws through Wayland without the GPU, D-Bus or the keyring. `unsandboxed cline-desktop` runs it without the sandbox."
      - label: "Claude Code"
        title: "Its own built-in sandbox"
        body: "Claude Code uses its own built-in sandbox for every command it runs. See `/sandbox` inside Claude."

  - type: text
    kicker: "Allow more"
    headline: "When an agent needs a site or folder."
    body: |
      Add it in `~/.config/coredesktop/sandbox/base.json` for every agent, or in `~/.config/coredesktop/sandbox/opencode.json` (and so on) for one agent:

      ```
      {
        "network": { "allowedDomains": ["docs.example.com"] },
        "filesystem": { "allowWrite": ["~/notes"] }
      }
      ```

      For Hermes' gateway to reach messaging services other than the Matrix server in its settings, add their domains the same way.

      The sandbox is Anthropic's [sandbox runtime](https://github.com/anthropics/sandbox-runtime), which uses bubblewrap and socat. The default rules are in [sandbox/config/](https://gitea.federated.computer/Federated_Computer/coredesktop/src/branch/main/sandbox/config).

  - type: final-cta
    headline: "Sign in and pick a model provider."
    body: "Before using an agent the first time, run `configure`."
    ctas:
      - label: "Configure your agents"
        url: "/utilities/#configure"
        style: primary
---