jauntbox Get started

Isolated dev boxes on Hetzner Cloud

Just jaunt some code
on a box.

A personal, self-deleting cloud dev box on your tailnet, where your code, secrets and sandboxed coding agents live instead of on your laptop. Your own sealed cloud machine, away from your laptop and your keys. New teammates get their own box, with the right setup, in a matter of minutes. Then they start their coding agent and ask it to onboard them on the project.

  • One box per developer
  • Agents in Docker
  • No keys from home
  • Humans merge, agents push
  • Tailscale only, no public ports
  • Open source, MIT
Get started Read the docs GitHub 
$ jauntbox up small --wait
→ server cpx42 in fsn1, Ubuntu 26.04
→ volume jauntbox-sam-home mounted at /home
→ joined your tailnet · no public ports
✓ ready
$ jauntbox
→ herdr session attached
Today's trip Tue 10 Nov · small · fsn1
TimeEventStatus
08:58Fresh server● Done
08:59/home mounted● Done
09:14Agent at work● In container
11:02Agent push to default branch✕ Refused
19:00Evening cutoff○ Box deletes itself

Example day. Once the box is down, you pay only for its volume.

The problem

Your laptop has been everywhere.

Work and life, one disk

Repos, database dumps and .env files sit next to your password manager, your browser sessions and your photos.

Agents with your keys

A coding agent on your laptop can reach your SSH agent, your cloud credentials and your whole home folder.

Day one lasts a week

A new hire spends days installing the right Ruby, Postgres and secrets before the first commit, and still ends up with a setup nobody else has.

The scare

No need to panic, but let's be cautious…ly pragmatic.

A coding agent can be prompt-injected by a README, an issue, a dependency or a web page. A compromised or careless agent will try what any script can try. So jauntbox assumes the worst about the thing running in the container, and limits what it can reach.

agent@box: ~/src/repo
agent@box:~/src/repo$ curl http://169.254.169.254/… agent@box:~/src/repo$ ssh 100.64.0.7 agent@box:~/src/repo$ psql -h 172.17.0.1 agent@box:~/src/repo$ git push origin main agent@box:~/src/repo$ echo "hello?" agent@box:~/src/repo$ _

What it might try, and what stops it

Read your cloud metadata, grab cloud credentials
Containers can't reach the metadata service, and the Hetzner token never enters the box's agent containers.
Wander your tailnet or other machines
Tailnet ranges are dropped from agent containers.
Poke services on the box itself: dev databases, sshd
Traffic from agent networks to the host is dropped.
Steal your other repos
Each run gets a short-lived (1 h) token for its one repo only. The GitHub App private key stays out of the container.
Push to main
Rulesets keep the default branch for humans, where GitHub allows it, and the wrap-up never pushes to the default branch.
Plant a git hook or fsmonitor so your own git runs its code
.git/config, hooks, modules and commondir are read-only inside the container, and .git itself can't be swapped.
Escalate
No Docker socket, all capabilities dropped, no-new-privileges, running as your uid. You use password sudo.
Run forever
A maximum duration (default 8 h), then a wrap-up into a pushed CONTINUATION.md. The box deletes itself.

This doesn't make an agent safe. It limits what a bad day can cost. And run agent-changed code inside the container, not on the host.

Safety and isolation

Walls first. Prompts second.

A coding agent's permission prompt is the last line of defence. jauntbox puts your work behind its own walls, on a machine that is not your laptop, so a bad tool call or a poisoned dependency costs you a rebuild, not your credentials.

What a bad tool call has to get through

  1. 1  Agent permission prompt
  2. 2  Docker container
  3. 3  Disposable box, deleted daily
  4. 4  Private tailnet, no public ports
  5. Your laptop, untouched
Invisible from the internet
The firewall allows no inbound traffic. The box is reachable only over your tailnet.
The box deletes itself
At 19:00, after 10 hours, or when idle. The volume with your code stays.
No keys from home
A private GitHub App mints one-repo tokens valid for an hour. Secrets live in the box's memory only.
Humans merge, agents push
Agents push branches and open pull requests. You merge.

What a container holds and can't reach →

Agents

Claude in a container, one repo at a time.

Agents run in containers on the box, never in your shell. Attach the box's herdr session, go to a repo's folder and run jauntctl agent. Claude opens right there in that pane, with only that checkout and a token for that one repo.

$ jauntbox
$ cd ~/src/<repo>
$ jauntctl agent
  • Interactive or unattended. Work alongside Claude, or hand it a one-line prompt and watch the log.
  • Several repos at once. One run, container and token per checkout under ~/src.
  • Your branch, live. The container mounts your checkout, so you see changes as they happen. Agents push branches, never merge.
  • Wrap-up before the box goes. The agent writes CONTINUATION.md and pushes it, so the next run picks up where it stopped.

Agents in the docs →

How it works

One trip, five stops.

A single Go binary, running against your own Hetzner Cloud account and tailnet. Nothing to host, no control plane in between.

  1. 1

    Pack

    jauntbox init once, then pick a size: small, big or huge.

  2. 2

    Depart

    A fresh server joins your tailnet, mounts your volume at /home and installs your toolchain.

  3. 3

    Work

    Type jauntbox to land in a herdr session that survives dropped Wi-Fi, or jauntbox ssh for a plain shell.

  4. 4

    Down

    jauntbox down stops the box safely. You pay for the hours you worked, plus a small volume.

  5. 5

    Evening

    Forgot? The box deletes itself at 19:00, after 10 hours, or when idle. jauntbox night keeps it up for agents until a deadline.

Five commands
jauntbox up small
Start a small box.
jauntbox resize big
More cores and memory in about two minutes, home intact.
jauntbox
Connect and start a herdr session.
jauntbox ssh
Plain SSH, over Tailscale.
jauntbox down
Stop the box safely.

Onboarding

First commit before lunch.

The box is described in one file. A new teammate, contractor or agent gets their own box, set up the same way as everyone else's: right runtimes, git set up, the project's repos checked out. The project's services start from its own docker compose file. No setup wiki, no "works on my machine".

Their coding agent is already on the box, with the code and the context it needs. The first thing they type is onboard me on this project, and they get a tour of the codebase, how to run it and where to start.

When they leave, revoke their key and destroy their box. Nothing of the project stays on their laptop.

Sam's first morning Mon
  1. 09:00Laptop out of the box. Accepts the invite.
  2. 09:10jauntbox up small. Box ready: git set up, repos checked out.
  3. 09:15jauntbox opens a herdr session. docker compose up starts the services. Test suite green.
  4. 09:20In a repo's pane, jauntctl agent opens Claude in a container: onboard me on this project. Gets a tour of the codebase.
  5. 10:30Pairs with a teammate, each on their own box.
  6. 11:45First pull request opened.

Server and system disk

Rebuilt, not repaired

Every box starts from stock Ubuntu and installs the same toolchain on first boot: Docker, language runtimes, herdr and Claude Code. When it breaks or ages, you replace it. A prebuilt base image for faster boots comes later.

  • image ubuntu-26.04 + cloud-init
  • tools go · rust · node · ruby · docker
  • life one day, deleted in the evening

/home volume

Your luggage

Code, dotfiles, shell history, Docker images and the box's Tailscale identity live on a separate volume that outlasts every rebuild. One volume, labelled like a bag.

  • volume jauntbox-sam-home · 100 GB
  • kept across rebuilds and resizes
  • never deleted by any automatic route

Roadmap

Where the trip stands.

Built in plans, each one reviewed and tested before the next starts.

See the full roadmap →

  • Walking skeletonDone
  • Secrets and GitHubDone
  • Privilege splitDone
  • Agents in containersDone
  • Your services, reachable by agentsNext

Cost

Pay for the trip, not the suitcase.

A cloud box billed by the hour, stopped when you are not using it, costs a fraction of a top-end laptop spread over three years. A light laptop is enough to drive it.

Per developer, per month Estimate
jauntbox, worked hours only €10–15
Light laptop, over 3 years €15–19
Total €25–34
High-end laptop, over 3 years €83–105

Estimates for a Rails or Django workload on Hetzner Cloud CX instances, EUR excl. VAT. Your hours and server type change the numbers.

Beta

Pack light.

jauntbox is one Go binary, open source under the MIT licence. During the beta you build it from source; packaged installs come later. You need Go, a dedicated Hetzner Cloud project with an API token, and a Tailscale API key. jauntbox init checks both and writes your config.

Get started Read the docs GitHub 
$ git clone https://github.com/WA-Systems-EU/jaunt && cd jaunt
$ go build -o ~/bin/jauntbox ./cmd/jauntbox
$ jauntbox init
$ jauntbox up small --wait
$ jauntbox