In developmentDocker · Shell

Agent Lab

Let a coding agent run with no guardrails, inside a box where that’s safe.

The boundary

Everything the agent can reach, and what it can’t.

Both agents run in their no-prompts mode, as an unprivileged user in a container that only has the project you named. Pick something the agent might try and see where it lands. Switch to codex-lab, or turn credentials off, and the map changes with it.

AGENT_LAB_NO_CREDENTIALS=1

$ claude-lab ~/code/myapp

Inside the container runs claude --dangerously-skip-permissions

~/code/myapp /workspace/myapp bind mount, read-write
claude-lab-home /home/claude named volume: agent login, MCP servers
agent-lab-github /github named volume: GitHub login
agent-lab-gcloud /gcloud named volume: Google Cloud login
tmpfs /tmp noexec, nosuid, 1 GB

cap_drop: ALL · no-new-privileges · pids_limit 4096

Not mounted

Your home folder
~/code/other-project
SSH keys and agent
Docker socket

The agent tries…

Works. The project folder is the one host folder the agent can change, so this deletes it on your computer too. Inside the project the agent can do anything.
Nothing there. Only myapp is mounted. For a task across several repositories, start the lab on their common parent folder instead.
Not there. Inside the container ~ is /home/claude, a Docker volume. Your real home folder and your SSH agent aren’t mounted.
There’s no Docker socket in the container, so it can’t start containers or reach the host through Docker.
Refused. The container drops every Linux capability and sets no-new-privileges, so nothing inside can gain more rights than it started with.
A fork bomb. It stops at the process cap, 4096 by default (AGENT_LAB_PIDS_LIMIT).
Works when credentials are mounted: the shared GitHub login lives at /github. Anything running in the session can read it, which is why a project’s setup commands ask for approval first.
Fails. With AGENT_LAB_NO_CREDENTIALS=1 the GitHub and Google Cloud volumes aren’t mounted at all. Use this for repositories you don’t trust.

The mounts and limits are taken from Agent Lab’s compose files. The probe results are explanations written for this page. They aren’t captured terminal output. Nothing here runs a container.

Setting up

Set up once, then one command per project.

After that, claude-lab ~/code/myapp or codex-lab . starts a session. Run one per terminal pane, one per project.

./install.sh
Set up a machine
Creates the Docker volumes for the logins and links codex-lab, claude-lab, lume-lab and agent-lab into ~/.local/bin. Images build the first time you use them.
agent-lab login
Sign in once
Runs both agents’ sign-in flows. agent-lab github login and agent-lab gcloud login do GitHub and Google Cloud, shared by both labs.
.agent-lab.json
Describe the project
Setup commands like npm ci or cargo fetch run inside the container on every launch. The first time a lab sees the file, it shows you the commands and asks.
agent-lab mcp import
Bring your MCP servers
Reads the servers you already have configured for each agent on the host and installs them in the matching lab.

When it needs a screen

A desktop in the container, or a Mac VM.

claude-lab gui starts a Linux desktop inside the container and prints a local noVNC address to open in your browser, with framewatch already installed. On Apple Silicon, claude-lab lume runs the agent in a macOS VM instead, for Xcode and native windows. The VM path doesn’t exist on Windows.

# Linux desktop, same isolation
claude-lab gui ~/code/myapp
# → http://localhost:6080/vnc.html

# native macOS, Apple Silicon only
claude-lab lume ~/code/myapp

Capabilities

What it does.

Engineers who want an agent working at full speed without giving it root on their laptop.

01
Unrestricted agent modes, limited to the project folder you mount
02
Credentials kept in Docker named volumes, outside the sandbox’s files
03
One install script, and images build the first time you use them
04
The same commands for logins and MCP servers across both agent CLIs

Specification

What it’s built with, and when.

Pulled from the repository each time this site is built.

State: In development
Discipline: Developer tooling
Shape: Developer tooling
Started: Aug 2026
Last change: Aug 2026
Commits: 37

Docker
Shell
PowerShell
Claude Code
Codex

Shell 44%
JavaScript 27%
PowerShell 24%
Dockerfile 5%

Related work

Built alongside Agent Lab

rev-local Automatic code review that keeps your code on your machine Andare Code A desktop app that hands tracker issues to a coding agent ctxfs A copy-on-write filesystem for running lots of agents on one repository

Put Agent Lab in your pipeline

Ask about hooking it up to the repositories and agents you already run.

Email dmoore@dwmmholdings.com Read the source

Agent Lab

Everything the agent can reach, and what it can’t.

Set up once, then one command per project.

Set up a machine

Sign in once

Describe the project

Bring your MCP servers

A desktop in the container, or a Mac VM.

What it does.

What it’s built with, and when.

Built alongside Agent Lab

Put Agent Lab in your pipeline