5 posts tagged with "docker"

AGRO publishes a ready-to-run sandbox image at ghcr.io/mifunedev/agro. You can start the image directly with Docker. This path needs no checkout, no local build, and no CLI. Each sandbox keeps its own workspace and its own logins in one home volume.

The default path is the agro CLI. agro sandbox install docker runs the same image, writes a registry entry, and owns the lifecycle. Use the plain docker run path below when you want Docker and nothing else on the host. See Creating a sandbox.

To learn AGRO, watch a clean machine become an agent-ready development environment. The demo installs the sandbox, attaches an editor, and checks the agents. Then the demo connects GitHub, and an agent creates its first issue and pull request.

The full Loom walkthrough shows the full demo. This post turns the demo into a written runbook. The runbook also states the corrections: safe defaults, when not to mount Docker, the contents of .agro/, and how worktrees isolate agent work. The video and the screenshots record the July 2026 demo. The installer and the wizard screens changed after the demo.

AGRO gives each repository one sandbox. The sandbox is an isolated Docker container, and the image contains no agent CLI. The image pins Node and gh. Each agent CLI enters through one command, agro harness install <id>. The catalog includes Claude Code, Codex, Pi, OpenCode, Hermes, and Grok Build.

A useful sandbox needs three steps. First, start the container. Next, install the tools that you use. Then, sign in each agent. This post walks the full first run: start, attach, install, and sign in to gh, Claude, Pi, and Hermes. Then the post starts a second sandbox on the same host and shows what the second sandbox inherits.

AGRO runs each coding agent inside a Docker container. The agent can thrash around in the sandbox and never touch your laptop. The question "container or full VM?" had a settled answer: the container wins. Last week, I researched the next contender. Should a Firecracker microVM replace the container under the agent?

The honest answer was no. The microVM is not weak. Firecracker exists for a job that AGRO does not do yet: untrusted agents for many tenants on shared hardware. For the job that AGRO does, the microVM fits worse. The research made the case for the container as the default even stronger. A microVM takes away the instant, live-editable sandbox that you get when you point the harness at a repo. The research also made me lay out three ways to box in an AI agent. The three boxes are a full VM, a container, and the microVM between the two. Here is the whole mental model.

Archived. This post shows the April 2026 multi-agent model. AGRO now gives one repository one sandbox. The image contains no agent CLI. You install each agent with agro harness install <id>. This page keeps the post for history.

Last week I ran ls ~/.nvm/versions/node and counted 14 Node versions. pyenv held three Pythons. A Rust toolchain from one Tauri experiment in 2023 was still there. npm did not list my ~/.local/share/pnpm/global directory. My laptop held years of old dependencies.

Codex started the problem. I wanted to try the OpenAI CLI next to Claude Code. The Codex install asked for Node 20. The Gemini CLI install asked for Node 22. Pi, the agent runtime that I wanted for the glue, asked for a clean Python 3.11 venv. Each agent CLI added new dependencies and a new chance to break the other two.

I stopped and put the whole setup in a container. Now my laptop runs Docker and one binary. Each agent CLI lives inside a sandbox, and I delete the sandbox in seconds.

The project is AGRO. The pattern is BYOH: Bring Your Own Harness. The next sections show the change to my workflow.

Three commands for each agent​

Run these commands on the host:

agro sandbox install docker --name my-agent   # create and start the sandbox
agro shell my-agent                           # open zsh inside the sandbox
agro destroy my-agent                         # delete the sandbox and its volumes

The sandbox is a Debian container with gh, tmux, Node, and the rest of the toolchain. In April 2026, the image also contained Claude Code, Codex, the Gemini CLI, and Pi. Today, the image contains no agent CLI. Inside the sandbox, install each agent that you use:

agro harness install claude
agro harness install codex
agro harness install pi

Each install lands in ~/.local in the home volume, so the install survives a container recreate. Then sign in to each agent once. See the Quickstart.

You no longer upgrade brew first. A CLI for Node 22 no longer breaks on Node 24. The host stays clean, and the sandbox does the work.