DevCell 发布面向 AI 编码智能体的容器化沙箱

Your AI agent can rm -rf / and you're fine.

DevCell is a containerized sandbox for AI coding agents. Run Claude Code, Codex, or OpenCode with full auto-approve. Your SSH keys, other repos, and host credentials stay out of reach.

Quickstart

Prerequisites: Docker Desktop or Docker Engine.

brew install devcell-sh/tap/devcell
cd your-project
cell claude

On first run, cell creates .devcell.toml and .devcell/ in your project directory, then builds the image (~5 min). Works with cell codex and cell opencode too.

What you get

• Isolated sandbox - agents edit freely inside your project; your host system is untouched
• 12+ MCP servers - Yahoo Finance, Google Maps, Linear, KiCad, Inkscape, and more. Backing tools ship in the image alongside their servers
• Claude Max/Pro support - runs Claude Code directly, no API key or proxy needed
• Stealth Chromium + zero-password login - cell login <url> opens a clean browser on your host, you log in, press Enter; cookies and localStorage sync to the container. The agent never sees your password. Anti-fingerprint Playwright replays sessions that pass Cloudflare and Kasada
• Remote desktop - VNC and RDP into the container to watch or interact with GUI apps
• 1Password secrets - list document names in .devcell.toml; fields are injected as env vars into the container at runtime, written to a RAM-only tmpfs, gone when the container stops
• Docker or VM engine - default: a Linux Docker container. --os macos runs a macOS VM on Tart, --os windows a Windows VM via winkit; same commands
• 4 primary stacks: base (minimal), dev (seed: stealth browser + IaC MCPs), ultimate (general development), bbb (ultimate plus specialist tools). Legacy: go/node/python/fullstack/electronics. See MIGRATION.md.
• Model ranking - cell models shows cloud models (Anthropic, OpenAI, Google via OpenRouter) and local ollama models ranked by SWE-Bench score and speed, side by side

Stacks

Published to ghcr.io/devcell-sh/devcell. Multi-arch: linux/amd64, linux/arm64. The dev seed and ultimate general development stack support extra capability modules; bbb retains the specialist tools previously bundled with ultimate (see MIGRATION.md). Legacy stacks (go, node, python, fullstack, electronics) still build.

Add-on modules (set modules = ["android"] in .devcell.toml):

Engines and guests

The guest is the OS inside the cell (--os); the engine is how the cell runs (--engine). Pick the guest and the engine follows:

cell claude --os macos       # open Claude Code in a macOS VM
cell build --os windows      # build the Windows VM image

Set permanently in .devcell.toml:

[cell]
os = "macos"

MCP servers

Baked into the image and auto-merged into each agent's config at container startup. User-defined servers are preserved. Where applicable, the backing tools ship too: KiCad, Inkscape, and OpenTofu are installed alongside their MCP servers, so the agent can run tofu plan, analyze PCBs, or edit SVGs. New servers ship with image updates.

Browser login & anti-bot protection

cell login lets the agent use authenticated sessions without ever seeing passwords:

cell login https://example.com   # opens a real browser on your host
                                  # you log in normally, press Enter
                                  # cookies + localStorage sync to the container
cell login --force https://...   # wipe saved session and start fresh

How it avoids bot detection: the login browser opens with no CDP debugging port — no --remote-debugging-port, no special flags. Cloudflare, Kasada, and similar systems cannot detect it as automated. After you close the browser, a separate headless CDP instance reads the cookies from the same profile and writes storage-state.json for Playwright. The agent replays the session; your password is never exposed.

The fingerprint (User-Agent, platform, browser brands) is read from your real installed Chrome binary and saved alongside the session so Patchright uses an identical identity.

Security

• Project directory mounted at /workspace, exposed inside the container as $DEVCELL_PROJECT_DIR ($WORKSPACE still set for compatibility). Host filesystem is unreachable
• SSH keys, .env files outside the project, and host credentials are not mounted
• Session user runs without root privileges
• 1Password secrets injected at runtime, never persisted
• GPG isolation per container (prevents SQLite lock contention)
• Gitleaks pre-commit hook and CI secret scanning

Configuration

Project config at .devcell.toml (created by cell init or first run). Optional global defaults at ~/.config/devcell/devcell.toml. See cell --help and the CLI docs for the full reference.

A JSON Schema for the config is published at https://devcell.sh/schema/<version>/devcell.json. Today <version> is always v0.0.0, tracking main; per-release directories can be added later without changing URLs. Add this line to the top of the file for editor validation and completion (taplo, Even Better TOML for VS Code, Zed, Neovim):

#:schema https://devcell.sh/schema/v0.0.0/devcell.json

The schema carries a top-level version field so you can tell which one you are looking at. The module, stack, and package catalog of the matching home flake is published next to it, so editors offer modules and stack completions and you can check what a stack already ships before adding a package:

• https://devcell.sh/schema/<version>/devcell-sh/home/modules.json: module name, description, MCP servers, size
• https://devcell.sh/schema/<version>/devcell-sh/home/stacks.json: modules enabled and packages installed per stack
• https://devcell.sh/schema/<version>/devcell-sh/home/packages.json: package version and which stacks ship it

Only v0.0.0 is published for now. It is regenerated by the schema-generate pre-commit hook (and on every task cell:build) whenever the config struct or the catalog changes; a drift test in internal/cfg backs that up in CI. Refresh the catalog with task schema:catalog (needs nix) after the home flake changes.

WireGuard tunnels

Add one [[wireguard]] block per tunnel to .devcell.toml with a standard wg-quick config. The container gets NET_ADMIN, /dev/net/tun, and brings the tunnel up at start. Secrets never land in the config file on disk:

• WG_PRIVATE_KEY (required): the [Interface] private key. Any inline PrivateKey is stripped and loaded from this variable at runtime.
• WG_PRESHARED_KEY (optional): applied to every [Peer] in the tunnel. Any inline PresharedKey is stripped the same way. Peers with different PSKs are rejected at validation time, so use one tunnel per PSK.

Set both in the host environment where you run cell. When a tunnel is enabled they are forwarded into the container by name (values never appear in the docker run command line), written to a /run/secrets tmpfs, and applied with wg set after the interface is up. No manual PostUp is needed.

Customization

Start simple, go deeper when you need to.

Runtime versions - drop a .tool-versions or mise.toml in your project. Runtimes install automatically at startup. No rebuild needed.

Add packages - add npm or Python packages in devcell.toml, then cell build.

Extend a stack - edit .devcell/flake.nix to add nix packages. Run cell build to apply.

Fork nixhome - fork the nixhome repo, point your flake to your fork. Upstream updates still merge cleanly.

Development

Building images

Local development uses cell build — task image:* is for CI/release only.

cell build                    # Rebuild the local cell image from this checkout
cell build --update           # Bump nix flake inputs + rebuild
cell build --thin             # Incremental, mounts nix store on a Docker volume
task image:pure:build         # CI/release: build pure base + ultimate
task image:impure:build       # [DEPRECATED] legacy Dockerfile path, kept one release

Testing

Tests use testcontainers-go and require Docker.

task test                     # Short mode - uses pre-built image
go test -v -timeout 600s ./test/...   # Long mode - rebuilds image first

Nix modules

The image is built from composable Nix home-manager modules (nixhome/modules/), assembled into stacks (nixhome/profiles/). Validate after edits:

task nix:validate    # Syntax check + attribute resolution across all stacks

Terminology

One-line model: a cell is the boundary; many projects live inside it; each project at a time spawns one container.

License

Apache 2.0