Self-host Containarium
v0.120.1Agent runtime giving each AI a persistent SSH-isolated box
- Stars
- 313
- Ports
- 8080 (REST API (gRPC-gateway)), 50051 (gRPC API (mTLS))
- Requires
- Incus/LXC, Kernel modules (overlay, br_netfilter, nf_nat), PostgreSQL, ZFS kernel module
What is Containarium?
Containarium provides persistent, isolated Linux environments for AI agents. Each agent receives its own system container (LXC/Incus or Kubernetes pod) with full systemd, real networking, and SSH access. The platform includes a sentinel (sshpiper + Caddy) for routing SSH and HTTPS traffic to containers, two MCP servers (platform-level and in-container agent-box) for structured tool access, and features like GPU passthrough, eBPF egress policies, ZFS-backed persistent storage, and JWT-based authentication with RBAC. It runs on a single Ubuntu VM or across a fleet of cloud/on-prem nodes, and exposes a CLI, REST/gRPC API, and a basic web UI. The project is Apache 2.0 licensed with no CLA.
Should you self-host Containarium?
Containarium scores 49/100 on selfhost.directory (how scoring works) and ranks #104 of 209 in AI Agents. It has 313 GitHub stars.
It shipped 12 stable releases in the past year. The latest, v0.120.1, came out on 28 October 2026.
Setup is advanced: plan for several services and some ongoing maintenance. It is Apache-2.0-licensed and written mostly in Go.
Its closest alternative on selfhost.directory is agentOS (64/100, 4 833 stars). It scores higher overall, so compare the two before you pick. See Containarium vs agentOS side by side.
Features
- Agent-box MCP server
- Audit log with hash chain
- CI runner with debug-on-failure
- Detached agent runs with resumable logs
- eBPF egress policy
- GPU passthrough
- KMS envelope encryption
- Kubernetes backendExperimental
- MCP-native CLI
- Multi-OS support
- Persistent storage with ZFS
- Sentinel for SSH/HTTPS routing
- SSH-native agent isolation
- Web UI dashboardFunctional, not opinionated
Containarium README
FAQ
Why LXC at all?
LXC provides full Linux OS with systemd, first-class SSH access, working Docker-in-LXC, real persistent filesystem, real users, and real sudo — feeling like a VM for the agent at a fraction of the resource cost.
Why not e2b / Modal / Daytona?
These are SaaS-only sandboxes for AI agents that optimize for short-lived, process-per-call execution. Containarium is self-hostable, MCP-native, and gives full persistent Linux boxes.
Why not Codespaces / Gitpod?
Codespaces and Gitpod are browser-IDE-as-a-Service, per-hour billed, and vendor-locked. Containarium is self-hosted, persistent, SSH/MCP-based, with no per-hour billing in OSS.
Why not Dev Containers / VS Code Remote Containers?
Dev Containers are project-scoped, IDE-coupled, and single-developer. Containarium gives many users or agents their own persistent boxes on shared infrastructure, IDE-agnostic.
Why not Vagrant?
Vagrant orchestrates VMs on a developer's local machine. Containarium hosts environments on shared remote infrastructure for many agents.
Why not Kubernetes?
Kubernetes orchestrates application containers across nodes. Containarium is the agent runtime that runs on top of Kubernetes (or LXC), giving each agent a persistent SSH-native box without handing it cluster credentials.
Why not Docker / Podman?
Docker is for application containers. Containarium uses LXC system containers with full Linux OS per container, real systemd, native SSH, Docker-in-LXC support, and persistent filesystem.
More in Infrastructure
cozystackCozystack is a self-hosted, open-source cloud platform turning bare metal into managed infrastructure with Kubernetes clusters, databases, VMs, and object storage.
DebOpsDebOps - Your Debian-based data center in a box
deployarooDeployaroo is a self-hosted, open-source web UI for deploying VMware vSphere VM templates via Ansible, with dashboard, history, user management, and Discord alerts.
DesignateDesignate is a self-hosted, open-source DNSaaS for OpenStack with REST API, CLI, and Horizon dashboard for DNS zone management.
emisaremisar gives AI agents declared infrastructure actions instead of shell. Policy gates actions, approvals for risky changes, tamper-evident audit trail.
EneruSelf-hosted UPS monitor that manages orderly shutdown of virtual machines, containers, and remote servers when power fails, with a web dashboard, terminal UI, and API.
ganetiGaneti is a self-hosted, open-source VM cluster manager for Xen/KVM with high availability, live migration, and automated allocation across 3-100 nodes.
home-enterprise-labopsHELO is a self-hosted, open-source Kubernetes infrastructure for learning GitOps, service meshes, and production patterns in your homelab.
IncusSelf-hosted, open-source system container and VM manager with unified REST API for local and remote management, scaling from single machine to clusters.
Jitsi Video BridgeJitsi Videobridge is an open-source, self-hosted WebRTC SFU that routes video for scalable multiparty conferencing.
LXCSelf-hosted, open-source low-level Linux container runtime for privileged and unprivileged system containers, driven by dotted lxc.* config keys and a stable C API.
my-self-hosting-servicesSelf-hosted Docker homelab with Authentik SSO, Traefik automated SSL, Cloudflare DNS automation, and Portainer. Includes n8n, OpenClaw AI, and microservices.
0 comments