Paddock

Paddock is a self-hosted platform that gives each AI agent its own computer. Instead of running an agent inside your laptop, your CI runner or a shared container, Paddock creates a box: a Linux machine with its own Ubuntu XFCE desktop, its own files and tools, and its own Docker daemon. The same platform can also create locked-down sandboxes for code you do not trust. Everything runs on one VPS that you own, installed with a single script that sets up the server, HTTPS and Docker. Paddock is aimed at developers and teams who give coding agents real work to do and want that work to happen somewhere isolated, observable and disposable rather than on their own machines. It is free, open source and MIT licensed, and you can drive it from a CLI, a dashboard, an HTTP API or TypeScript and Python SDKs. Agents that write code, run commands and browse the web need somewhere to do it. Handing them your own machine means they inherit your credentials, your files and your network. Running them in a bare container is often not enough either, because they may need a desktop, a Docker daemon or state that survives between runs. Paddock's answer is to make the agent's environment an explicit object you create, configure and throw away: a box with a lifetime, a network policy, a snapshot history and, optionally, drives that outlive it. That reframes agent execution as something you provision and inspect rather than something that happens invisibly on the machine you are typing on. Every box ships with an Ubuntu XFCE desktop. You open it with paddock desktop, and an agent can run GUI applications on it with paddock exec --desktop and capture what is on screen with paddock screenshot. That makes computer use inspectable: agents open GUI apps on the box desktop and take screenshots to check what they built. The project's own example is a coding agent that built a Rust application inside a box, opened it on the desktop and took the screenshot shown on the site. Because the desktop belongs to the box, agents can launch and look at real graphical software without touching your own screen, and the output can be reviewed afterwards rather than trusted blindly. A box can also be a sandbox. Network access can be set to allow all, deny all, or an allowlist of domains and CIDRs, and that policy can be changed on a running box. Cloud metadata is always blocked. You can set a run limit so a task cannot run forever, and roll the box back to any snapshot. Snapshots are saved every minute and on stop, which means an agent that breaks its own environment can be restored instead of rebuilt. The same mechanisms let you run code you do not trust at all: lock the network to deny-all, give the workload a time limit, and throw the box away when the run finishes. Docker runs inside the box through Sysbox, so an agent can build images and start containers without needing a Docker socket from the host. Drives are folders under /mnt that outlive the boxes using them; a drive mounts read-write into one box at a time, or read-only into many, which makes it possible to share a cache or a dataset across runs. Boxes can hold isolated Linux users with private homes plus shared group folders under /shared, so several people or agents can work side by side. Access is deliberately ordinary: SSH and scp into the box, and public HTTPS URLs for its ports with paddock host. Paddock is designed to be driven from wherever you already work. The CLI creates, execs into, screenshots and deletes boxes — for example paddock new --ttl 3600 --network deny-all --tag task=run-tests, followed by paddock exec current -- npm test and paddock delete current --yes. Boxes can carry tags and a TTL. The dashboard lets you create boxes, open their desktops and watch agents work from a browser. Underneath sits an HTTP API with TypeScript and Python SDKs, webhooks and API keys, so box creation can be part of a pipeline rather than a manual step. Installation is a single script on an Ubuntu or Debian VPS with ports 80 and 443 open, using your own domain or .sslip.io for HTTPS; the CLI and the agent skill are then installed on your laptop with paddock login and paddock skill install. The practical benefit is separation. An agent's files, tools and desktop persist between runs because they live in the box rather than in your shell session, so a follow-up task can start where the last one stopped. At the same time the box is disposable: stop, resume, fork, restore and delete are single commands away. Because the box sits on a server you control, you decide its network policy, its lifetime and who can reach it, and you keep the artifacts it produces. And because the software is MIT licensed and self-hosted, there is no third party holding the machine your agent works on. Concrete workflows described on the site include a coding agent building and opening a GUI app inside a box, an agent running a test suite through paddock exec, and a scraping or documentation task pinned to an allowlist of domains or to deny-all networking. The illustrative box list on the site shows named jobs — fixing a login bug with Claude, running tests with Codex, scraping docs with OpenCode under deny-all networking, and a nightly build with Pi mounted to a cache drive — each with its own machine, network rules and storage. Sandboxes for untrusted code are the other half of the picture: run the code, cap its time, then roll back or delete the box afterwards. Paddock is for developers, platform engineers and small teams running coding agents in earnest, especially those who already have a VPS and prefer to keep agent execution in-house. It works with Claude Code, Codex, OpenCode, Pi, Prime and Kimi, which come preinstalled and can be sent a task with paddock prompt, and with your own code through the HTTP API, TypeScript and Python SDKs, webhooks and API keys. The stack is a Docker-based Ubuntu box with an XFCE desktop and Sysbox for nested containers, installed by script on Ubuntu or Debian and fronted by HTTPS on your domain. Pricing is simple: the software is free and open source under the MIT license, and the VPS is yours to pay for. In short, Paddock turns "let the agent do it" into a controlled operation. Each agent gets a real Linux computer that keeps its files, tools and desktop between runs, or a locked-down sandbox with a network policy, a run limit and rollback. You create it from the CLI, the dashboard or the API, hand it to a preinstalled agent, watch it work on the desktop, and throw it away when the job is done — all on one VPS you own.