code-on-incus

code-on-incus gives each AI agent its own full system container with root access, Docker, package managers, and systemd—without exposing your host system or credentials. Agents can work like they would on a real server: install packages, run services, manage cron jobs, and use Docker. SSH keys, environment variables, and Git tokens stay on the host and are never exposed to the agent unless you explicitly mount them. The tool includes kernel-level threat detection via nftables that monitors for reverse shells, credential scanning, DNS tunneling, and data exfiltration, automatically pausing or killing containers on suspicious activity. Sessions persist across restarts, multiple slots can run in parallel with full isolation, and workspace files are preserved even when containers are deleted.

1. **Prepare Your Environment**: Ensure Incus is installed (`sudo apt install incus`) and initialized. Verify storage pools and network bridges are configured. 2. **Define Requirements**: Create a JSON config file with your specifications (e.g., `agent-config.json`): ```json { "container_name": "dev-nodejs-20241115", "language": "nodejs", "dependencies": ["nodejs@20", "npm@10"], "workspace_mount": { "host_path": "/home/user/projects/chatbot", "container_path": "/workspace" }, "resources": {"cpu": 2, "memory": "4GB"} } ``` 3. **Launch the Container**: Run the skill with your config: ```bash incus launch images:ubuntu/22.04 dev-nodejs-20241115 --config user.user-data="$(cat agent-config.json)" ``` 4. **Connect and Code**: Use the provided SSH command or VS Code remote connection. For Claude integration, configure the Incus bridge in your AI client settings. 5. **Manage Sessions**: Use `incus list` to monitor containers. To persist changes, avoid the `--force` flag during deletion. For cleanup, run: ```bash incus delete dev-nodejs-20241115 --force ``` **Tips:** - Use `incus config device add` to mount additional volumes (e.g., for datasets). - For GPU acceleration, add `--device gpu` to the launch command. - Monitor resource usage with `incus monitor` to avoid over-allocation.