Everything an agent's computer needs
HareBox is a full VM per agent, with the controls to run thousands of them as a product. Each capability says what runs today, so you can plan around facts.
How to read the status labels. HareBox has no public service yet. A label says how far each capability has got on the local build.
- Works locally
- Real behaviour, tested on the local build.
- Real VMs, locally
- Runs inside real VMs on the development machine. No server has run it yet.
- Simulated
- The API works; the machine side is a labelled simulator or stand-in.
- In development
- Designed, and being built. Not available yet.
The machine
A whole Linux computer per sandbox, not a container.
- Full Ubuntu 24.04 VM Real VMs, locally
Its own kernel, root through sudo, real systemd, on KVM.
- Docker that just works Real VMs, locally
Docker Engine, BuildKit and Compose, natively, with no socket tricks.
- Nested /dev/kvm Real VMs, locally
Run QEMU, Firecracker or an Android emulator inside the sandbox.
- Toolchains pre-installed Real VMs, locally
Node 24, Python 3.12, Go, Rust, Bun, JDK 21, gh, Chrome and VS Code in the browser, pinned, checksummed and listed.
- Agent CLIs pre-installed Real VMs, locally
Claude Code, Codex, OpenCode, pi and OpenClaw in the image; more install on first use.
- Four sizes, plus custom Simulated
small to xlarge, or any shape in between at the same per-vCPU and per-GB rate.
- Live resize Simulated
Grow CPU and memory without a stop, within host limits.
- Windows apps through Wine Real VMs, locally
64-bit Wine on the desktop, to automate legacy Windows tools. No tested-apps list yet.
Lifecycle and state
Pause, copy and rewind work without losing it.
- Sleep that keeps programs running Real VMs, locally
Memory and processes survive. Wake into the exact moment you left.
- Exact forks Real VMs, locally
Copy a running VM with its memory and latest writes, with a fresh identity each time.
- Fork to many at once Real VMs, locally
One prepared sandbox becomes N independent ones in a single call.
- Versioned templates Simulated
Save a prepared machine, start from it, share it with a one-time code.
- Point-in-time restore Simulated
Rewind to any saved state from the last 14 days.
- Auto-stop Simulated
Every sandbox stops itself an hour after it starts, unless you say otherwise.
- 14 days of free stopped disks Works locally
Then paid cold storage, never silent deletion.
- Schedules Works locally
Wake, stop, run a command or send a prompt on a cron schedule.
Agents
Drive coding agents from outside, with streams and spending limits.
- Prompt from outside, streamed Works locally
Send a task, then follow it over SSE, WebSocket or signed webhooks, resuming from a cursor.
- Real agent CLIs, driven for you Real VMs, locally
Claude Code, Codex and OpenCode run as real CLIs in the VM; seven more are listed, or bring your own.
- Steer and interrupt Simulated
Add guidance mid-turn, or stop one conversation without touching the others.
- Credentials proxy Works locally
The sandbox holds a placeholder. The real key is added on the way out, only for the host its rule names.
- AI spend caps Works locally
A dollar cap per prompt, sandbox or project, enforced at the proxy.
Desktop and computer use
Watch an agent work, or let it use the screen.
- Desktop in the browser Real VMs, locally
A 1080p Linux desktop with Chrome, streamed to your browser, to watch an agent or take over.
- Computer use for every harness Real VMs, locally
Screenshot, click, drag, type, scroll and read the accessibility tree, through the API or an MCP server in every harness.
- Screen recording Real VMs, locally
Record a session to MP4 for review or audit.
Network and access
Reach what runs inside, and control what gets out.
- Public HTTPS URLs Real VMs, locally
Expose a port with a private URL: any method, streaming and WebSockets, and the sandbox wakes on the first request.
- Token, OIDC or mTLS on URLs Simulated
Atomic token rotation, with no window where the old link is open.
- Custom domains Simulated
Serve a sandbox on your own domain, with automatic TLS.
- Firewall root can't remove Simulated
Rules are API objects outside the VM, so a tenant with root still can't change them.
- Dual-stack and static IPs Simulated
IPv4 and IPv6, with addresses you can keep across resumes.
- Private mesh Simulated
An encrypted network between a project's sandboxes.
- SSH, SCP and forwarding In development
Plain ssh, scp, port forwarding and VS Code Remote-SSH.
Platforms and teams
Run a product on top: one sandbox per customer, metered.
- A sandbox per customer Works locally
Documented patterns for products that give every user a computer.
- Exact per-sandbox usage Works locally
Read exactly what each sandbox cost, to bill your own customers.
- Usage by project, label or member Works locally
One call answers what each customer, team or experiment spent, or exports every sandbox's charge as CSV.
- Hard budgets Works locally
Dollar limits on an account, project, fleet, label or API key, with an action when reached.
- Environments Works locally
Variables, secret files and versions, plus a switch that keeps your secrets out of third-party sandboxes.
- Fleets Works locally
Hold a group of sandboxes at a desired size, from a template.
- Organizations and seats Simulated
Members, roles and per-member caps.
- Scoped API keys Works locally
Limit a key by action, sandbox, project, label, rate, budget and IP.
- Audit log Works locally
Who did what, to which resource, from which IP, and the result. Read it over the API or with harebox audit.
- One-shot runs for any CI Works locally
harebox run starts a fresh VM, runs one job, deletes it, and exits with the job's code.
- GitHub Actions labels Simulated
runs-on labels by size. Needs a registered GitHub App, which isn't connected yet.
Developer experience
Built so a person or an agent can run it alone.
- A CLI that speaks JSON Works locally
JSON when piped, JSON Lines when streaming, and every error says what to do next.
- Python, TypeScript and Go SDKs Works locally
Every API operation as a typed method, tested against one contract suite.
- Signed webhooks Works locally
Up to 100 endpoints and 64 event types, with history and redelivery in the API.
- Docs agents can read Works locally
llms.txt, an agent skill and an AGENTS.md template, for laptop agents that drive HareBox.
- Agent self-sign-up Simulated
An agent registers itself; a human claims the account and adds a card.
- OpenTelemetry export In development
Metrics, lifecycle logs, traces and token data to your own collector.
See them working together
The use-case guides put these features into step-by-step recipes, with costs.