coi
Give the agent a machine. Just not yours. Each AI coding agent gets its own isolated machine with root, Docker, and systemd - active defense detects and stops t
What is coi?
Give the agent a machine. Just not yours. Each AI coding agent gets its own isolated machine with root, Docker, and systemd - active defense detects and stops threats automatically.
Overview of coi
What it is
Coi (Code on Incus) runs your AI coding tool (Claude Code, Codex, opencode, pi, omp) inside its own isolated Linux system: a full-OS container with root access, systemd, Docker, and the freedom to install anything. The agent works like it would on a real server, but it cannot touch your host, cannot see your credentials, and if it does something dangerous, coi pauses or kills the container on its own.
Key features
- Real machine, not a locked box — Incus system containers give the agent a full OS: root, systemd, native Docker, package managers, services.
- Correct file ownership — workspace edits land on the host owned by you, with no chown dance.
- Credentials stay home — SSH keys, tokens, .env, and host environment variables never enter the container unless you mount or forward them, and coi shell lists every grant at startup.
- Active defense — kernel-level monitoring catches reverse shells, C2, exfiltration, and DNS tunneling in real time, then auto-pauses on HIGH and auto-kills on CRITICAL.
- Network isolation — nftables egress control in three modes (open, restricted, allowlist), DNS pinning, and per-host port scoping.
- Parallel agents — several slots per project, each with its own home directory, isolated from one another.
- Profiles — reusable named setups (image, tool, limits, network, build scripts, agent instructions) applied with a single flag, with inheritance.
Use cases
- You run AI coding agents and want them to have full machine access (root, Docker, package managers, services) without risking your host.
- You want to know when an agent does something suspicious, not find out after the fact.
- You run several agents in parallel and need them isolated from each other.
- You want persistent dev environments that survive restarts, not throwaway containers that lose your setup every time.
- You care about your credentials never ending up inside an agent-controlled environment.
Getting started
bash # 1. Install curl -fsSL https://raw.githubusercontent.com/coipond/coi/master/install.sh | bash # 2. Build the base image (first time only, ~5-10 min) coi build # 3. Start coding, from any project directory cd your-project coi shell
License and pricing
License is MIT. The project is open source.
Based on the project's public README and repository metadata.
