stedding runs sandboxes on a Linux box in my homelab with KVM. The agent loop stays where it already runs, in my case aludra, and sends each tool call into a sandbox over SSH. Each sandbox is a Firecracker VM in its own transient systemd unit, run as an unprivileged user.
A sandbox can reach the internet and nothing else. Each one gets its own tap device on a /30, and an nftables policy drops its traffic to the host, the LAN, the tailnet, cloud metadata addresses, other sandboxes and all of IPv6. Everything else goes out through NAT. The drops sit ahead of ufw and Tailscale’s own rules, and a drop in nftables is final whatever another table accepts.
A cleanly shut-down disk can be saved as a template, and a new sandbox from a template is a sparse copy that takes about a quarter of a second. A cold boot takes 2.7 seconds. Sandboxes nobody is connected to get paused with their memory after a minute, and connecting again resumes one to SSH in under a quarter of a second, with its processes still running.
The key a client uses can only run a fixed set of commands, like connect, new, save and rm, through a forced command in authorized_keys. It gets no shell and no port forwarding. The base image is Ubuntu 26.04 with Node, pnpm, Rust and Tauri’s Linux build libraries, and no credentials or browser.
In the Wheel of Time, a stedding is an Ogier refuge where no one can touch the One Power.