| AI Sandbox |
Federated CoreDesktop installs opencode, Hermes Agent, Cline Desktop and Claude Code, and runs them in a sandbox that keeps them out of your keys, passwords and other files. |
| type |
compact |
eyebrow |
title |
subhead |
ctas |
logTitle |
log |
| hero |
true |
opencode · Hermes Agent · Cline Desktop · Claude Code |
AI agents that can't wander off. |
CoreDesktop installs four AI coding agents and runs them in a sandbox. They can change your project, and not much else. |
| label |
url |
style |
| Sign in your agents |
/utilities/#configure |
primary |
|
|
|
|
~/Projects/site $ opencode |
| tag |
text |
| Sandbox |
Write access: ~/Projects/site only |
|
| tag |
text |
| Read |
Reading content/_index.md and hugo.toml |
|
| tag |
text |
| Write |
Edited layouts/partials/header.html |
|
| think |
tag |
text |
| true |
Agent |
Trying to read ~/.ssh/id_ed25519 |
|
| tag |
text |
| Blocked |
~/.ssh is hidden from the sandbox |
|
| tag |
text |
| Net |
github.com, npm and PyPI: allowed |
|
| tag |
text |
| Blocked |
pastebin.example: not on the allow list |
|
| done |
text |
| true |
Done. 1 file changed, nothing else touched. |
|
|
|
| type |
kicker |
headline |
columns |
| split |
In the sandbox |
What an agent can and can't do. |
| title |
items |
| It can |
| Change files only in the directory you start it from, plus its own settings and a few package caches. So start it from a project directory. |
| Reach AI providers and common developer sites: GitHub, Gitea, npm, PyPI, crates.io, RubyGems, the Go module proxy and archlinux.org. |
|
|
| title |
items |
| It can't |
| Read your SSH keys, password stores or browser profiles |
| Read Flatpak apps' data: browsers, Signal, Telegram and the rest |
| Read your Nextcloud password, cloud and Git credentials |
| Read the other agents' logins |
|
|
|
|
| type |
kicker |
headline |
columns |
items |
| cards |
The agents |
Four agents, one sandbox. |
2 |
| label |
title |
body |
| opencode |
Sandboxed when you type it |
Typing `opencode` runs it in the sandbox. To run it without, type `unsandboxed opencode`. |
|
| label |
title |
body |
| Hermes Agent |
Talk to it over Matrix |
`hermes` or `hermes-agent` runs in the sandbox, and so does its gateway, which lets you talk to Hermes through Matrix and other messaging apps. Its sandbox allows local sockets but hides your D-Bus session, SSH agent, Docker, Tailscale, X11, tmux and browsers. |
|
| label |
title |
body |
| Cline Desktop |
Your projects in ~/Projects |
Opened from the app menu. It can change files in `~/Projects`, open projects elsewhere only to read them, and reach cline.bot. It draws through Wayland without the GPU, D-Bus or the keyring. `unsandboxed cline-desktop` runs it without the sandbox. |
|
| label |
title |
body |
| Claude Code |
Its own built-in sandbox |
Claude Code uses its own built-in sandbox for every command it runs. See `/sandbox` inside Claude. |
|
|
|
| type |
kicker |
headline |
body |
| text |
Allow more |
When an agent needs a site or folder. |
Add it in `~/.config/coredesktop/sandbox/base.json` for every agent, or in `~/.config/coredesktop/sandbox/opencode.json` (and so on) for one agent:
```
{
"network": { "allowedDomains": ["docs.example.com"] },
"filesystem": { "allowWrite": ["~/notes"] }
}
```
For Hermes' gateway to reach messaging services other than the Matrix server in its settings, add their domains the same way.
The sandbox is Anthropic's [sandbox runtime](https://github.com/anthropics/sandbox-runtime), which uses bubblewrap and socat. The default rules are in [sandbox/config/](https://gitea.federated.computer/Federated_Computer/coredesktop/src/branch/main/sandbox/config).
|
|
| type |
headline |
body |
ctas |
| final-cta |
Sign in and pick a model provider. |
Before using an agent the first time, run `configure`. |
| label |
url |
style |
| Configure your agents |
/utilities/#configure |
primary |
|
|
|
|
