<- all tokdocs
2026.09.17@github.signals

AgentBox Gives Each Coding Agent Its Own Docker Box, and Boots New Ones From a `docker commit` Checkpoint

AI
Watch on TikTok

View on TikTok ->

AgentBox is a real MIT-licensed CLI that puts Claude Code, Codex, or OpenCode inside a sandboxed box per agent run, and its checkpoint system is docker commit under the hood. The video scrolls the GitHub README for madarco/agentbox and repeats the headline bullets, which check out. The part that does not survive verification is the closing line about code that "never touches your real system," because the box bind-mounts your host's .git/ directory and agent commits land in your real repository right away. Everything else in the 36 seconds is accurate, if thin on the parts that matter when you actually run it.

What one command sets up

agentbox claude creates a box and launches Claude Code inside a detachable tmux session. The README describes a box as a Docker container with a FUSE overlay, and the docs describe the seeding step precisely: AgentBox copies your uncommitted work, meaning a git stash plus untracked files, into the box, and /workspace becomes a git worktree on a branch named agentbox/<box-name>.

Each box also gets a browser reachable over noVNC (agentbox screen), a local URL tunnel for web projects (agentbox url), a persistent shell (agentbox shell), and a VS Code or Cursor attachment through the Dev Containers extension (agentbox code). Requirements are modest: macOS on arm64 or Intel, or Linux, plus Docker Desktop or OrbStack and Node 20.10 or newer. The first run builds an agentbox/box:dev image of roughly 1 GB, once.

The checkpoint speed claim, and where it comes from

The video calls the checkpoint system the standout feature and says a warm snapshot boots in under a second. The README states "Sub <1s startup of new boxes from a previous checkpoint," and the docs say a new box boots from a checkpoint in about a second instead of installing from scratch. I could not benchmark this, so treat the number as the project's claim rather than a measured result.

The mechanism is documented and mundane, which is a point in its favor. A checkpoint is a docker commit of the box's writable layer into a project-scoped image, capturing installed dependencies, build output, and caches. A new box starts from that image and skips workspace seeding entirely. The docs also name the limit the video does not: the writable layer is captured, and docker-in-docker volumes are not. If your stack runs Postgres as a sidecar container, that database comes back empty and you need re-seeding logic rather than a restored state marker.

The credential handling is the strongest part, and it has a name

The video says credentials stay safe on the host while agents work freely. The docs back this with a specific design. Anything that touches a remote runs on a host relay, a small process on your machine that executes git using your real SSH agent and ~/.gitconfig. SSH keys and tokens never enter the box.

The approval model is graded rather than all-or-nothing. Pushing to the box's own agentbox/<box-name> branch and opening a pull request run without prompting. Pushing a branch the agent switched to itself, gh pr merge, gh pr checkout, and any file transfer that escapes the project folder each raise a host-side approval prompt. That is a more useful threat model than per-command approval, and the video skips it.

The isolation claim is oversold in one specific way

The transcript ends with "a sandbox that never touches your real system." The docs contradict this directly for the local provider. The box's /workspace is a worktree against the same .git/ that is bind-mounted from your host, so commits made inside a box land on your machine immediately, on that box's branch. Tracked work needs no sync because it is already in your repository. That is a deliberate feature, and it is also the opposite of untouched.

The isolation boundary also varies by provider, which neither the video nor the README badge art makes clear. The default local provider is a Docker container sharing your host kernel. The docs reference a Firecracker microVM for the Vercel provider. A container and a microVM are not equivalent boundaries, and the README's use of the word "VM" throughout papers over that difference.

What the video omits about running this in the cloud

The README provider matrix lists local Docker, remote Docker over SSH, Hetzner, Daytona, Vercel, E2B, and DigitalOcean. Live snapshots are marked experimental for Daytona and supported elsewhere. The docs add hard session caps that override persistent box settings: roughly one hour on E2B and about 45 minutes on Vercel. For long-running agent sessions those caps matter more than boot speed.

Adoption is early. As of 2026-09-19 the repository shows 453 stars and 32 forks, created on 2026-05-12, with the most recent push that same day. The npm package @madarco/agentbox first published on 2026-05-17, is at version 0.32.1, and recorded 7,448 downloads in the last 30 days. The frame captured in the video shows 402 stars, so the count moved by about 50 in the two days since upload.

Key Takeaways

  • agentbox claude starts a Docker box with Claude Code in tmux, copies your uncommitted work in, and gives the box its own browser, shell, tunnel, and IDE attachment.
  • Checkpoints are docker commit snapshots of the writable layer, which is why new boxes start warm. Docker-in-docker volumes are excluded, so sidecar databases come back empty.
  • Credentials stay on the host through a relay process that runs git with your real SSH agent. Pushing to the box's own branch is unprompted, and anything reaching further asks for approval.
  • The video's "never touches your real system" line is wrong for the local provider, because the host .git/ is bind-mounted and agent commits land in your repository on an agentbox/<box-name> branch.
  • The sub-one-second checkpoint boot is unverified here. It is the project's own claim in the README and docs, and I did not measure it. The same applies to the ~1 GB image size and the E2B and Vercel session caps, which come from the documentation rather than a test run.
  • E2B and Vercel cap sessions at roughly one hour and 45 minutes, which constrains long agent runs regardless of how fast a box boots.
  • The project is young: created May 2026, version 0.32.1, 453 GitHub stars, 7,448 npm downloads in the last month.

Resources

Published September 17, 2026. Writeup generated from a favorited TikTok.