DevOps Agent

Most agents with a shell tool have to be timid about what they run on the host. This one puts the blast radius in a container: one container, one mounted workspace/ directory, so the agent can install packages, edit files, and run builds without supervision.

Two layers do the protecting, and they protect different things. sandbox.py confines the agent to the workspace, enforces a command policy, and writes an audit log; that protects the repository. The runtime container protects the host: read-only root filesystem, every capability dropped, no-new-privileges, a pid ceiling, a memory limit, nothing mounted except the workspace, and no Docker CLI in the image, because a socket to the host daemon would undo the whole arrangement. The command denylist is explicitly not a security boundary (any shell denylist falls to base64 or $IFS); it exists to catch a confused model early and hand it an error it can recover from.

The loop runs against a local model by default, Qwen 3.6 35B-A3B served by Unsloth Studio with multi-token-prediction speculative decoding, the fastest and smallest loadout in my benchmarks at roughly 147 tokens per second. Cloud providers plug in through a small module that speaks the Anthropic and OpenAI wire formats, with the credential read from a file the model never sees. The repository is structured as a guided walkthrough: the sandbox and agent loop start as stubs against a given test suite, and a finished reference implementation lives on a protected branch. Every guard in the loop is covered by tests that drive it with a scripted model.

Source lives on my self-hosted GitLab.