o3s

Everything ready. Everything parallel. Everything locked down.

If you are not willing to trade security for productivity, o3s is a match. Let an agent generate every line of code, and review every line by hand or none at all. Either way, which hosts your agents reach and which secrets they can read stays yours to decide.

Anthropic and OpenAI both ship a reference devcontainer, deliberately minimal, and both tell you to bring your own network controls. o3s starts where they stop: productivity on steroids, and deterministic enforcement (harness) to get there.

We do software development for a living, and o3s is our answer to keeping pace: trusted environments, several projects at once, and several features inside each. AI will not be the death of good engineering. It is the golden era of agentic software engineers. This is how we build with it and still stand behind every line that ships.

Security

You write the whole policy in one file, config.toml, one table per host:

["github.com"]
ports = [22, 443]

["api.anthropic.com"]
ports = [443]

["api.openai.com"]
ports  = [443]
secret = "OPENAI_API_KEY" # injected for this host only, never inside the cage

Productivity

You list every project in one file, o3s.code-workspace, one folder per repository or worktree:

"folders": [
  { "name": "devcontainer-features", "path": "/home/ubuntu/projects/devcontainer-features" },
  { "name": "infra",                 "path": "/home/ubuntu/projects/infra" },
  { "name": "infra.worktrees",       "path": "/home/ubuntu/projects/infra.worktrees" },
  { "name": "malea-backend",         "path": "/home/ubuntu/projects/malea-backend" },
  { "name": "malea-docs",            "path": "/home/ubuntu/projects/malea-docs" },
  { "name": "malea-graph",           "path": "/home/ubuntu/projects/malea-graph" },
  { "name": "malea-web",             "path": "/home/ubuntu/projects/malea-web" },
  { "name": "works-on-my-machine",   "path": "/home/ubuntu/projects/works-on-my-machine" }
]

Open it and every repository lands in one source-control view, worktrees nested under the repository they came from:

Run whatever agent you like, several at once, each on its own branch. They work in parallel without colliding, and everything lands in one place for you to review.

Iteration

Rootless Docker and minikube can run inside the sandbox, so an agent can stand up your whole stack, break it, and stand it up again without touching anything real. Two things have to hold: the infrastructure has to behave like production, and the loop from failure to next attempt has to be short.

References

[!TIP] Is o3s worth your limited time? Decide on your security model:

My agent is actively malicious and tries to escape
❌ No, a VM boundary is stronger than containers.

My long-leash-but-not-weaponized agent needs deterministic boundaries
✅ Yes, the architecture delivers security coupled with convenience.

See the comparison for others working on the same problem.

Something here you would do differently? Open an issue, send a pull request, or just get in touch. And if one of the others fits you better, take it, as long as you keep both your security and your productivity. You are always welcome back.

Getting started

Prerequisites: Docker, VS Code, and the Dev Containers extension.

1. Clone the repo.

   git clone https://github.com/Hansehart/o3s.git
   

2. Open it in VS Code and run Dev Containers: Reopen in Container.
3. Open .devcontainer/o3s.code-workspace and keep your projects in ~/projects.

[!TIP] Make it yours in the customization guide.

[!WARNING] Only ~/features, ~/o3s, and ~/projects survive a rebuild. Keep your work in ~/projects.

What the name means

Read every line, shape it however you like, and make the whole setup truly your own to trust and extend.

Give AI agents and untrusted code a long leash while you control the network they reach and the secrets they read.

Built for engineers and their agents to take your whole stack from prototype to production with minimal friction.

Agents, containers, languages, and all your projects, wired together into one platform you just open and use.

open secure software suite, or osss, shortened to o3s.