Cage - Containment-First Agent Control Plane
Cage is a self-hosted, containment-first control plane for coding agents, built for Vultr Agent Rush. Every tool call is mediated by the control plane, and every action executes inside an ephemeral Docker sandbox on a Vultr VM: no network, no IPC, read-only root, UID 1000, dropped capabilities, 128 PIDs, 512 MB RAM, and a 64MB tmpfs workspace that cannot fill the disk. The agent's LLM calls go through Vultr Serverless Inference (qwen3.8-27b); the API key never enters the sandbox. Only sandboxd touches the Docker socket, behind a bearer-token API, and the sandbox image is pinned server-side. Eight containment drills - rm -rf /, infinite loop, fork bomb, secret probe, network probe, host write, read-only canary, cross-task - all report CONTAINED on the live deployment, each leaving a signed receipt. Every run is sealed into an Ed25519-signed evidence pack (task, events, probe reports); the verifier script and the pinned key fingerprint (a156b18f82b0efe3) let anyone check it. Honest boundary: container-scoped containment, not kernel-level isolation. Live demo: https://139-180-191-46.sslip.io - repo: https://github.com/Pawnnwap/cage
Category tags:
For Innovators & Creators