hotcell
Run isolated AI agent sandboxes on your own hardware
About hotcell
hotcell is a self-hostable AI agent sandbox SDK that runs on a Mac Mini, a cloud VM, or bare metal. It reaches LLMs and GitHub through a gateway proxy, supports metering, capping, and revoking tokens per sandbox, and offers Docker, Firecracker, and Apple VZ isolation under one interface.
Best for
Best use cases
Deploy agent sandboxes on your own hardware
Run multiple agent tasks in isolation
Protect API credentials like OpenAI and GitHub through a proxy
Monitor sandbox CPU, memory, and cost
Features
Multiple isolation backends
Unified support for Docker, Firecracker (Linux/KVM), and Apple VZ (macOS).
Credential gateway
Access LLMs, GitHub, and other HTTP APIs with per-sandbox tokens while real keys stay in the gateway.
Resource admission control
Shows each sandbox's CPU, memory, and cost in real time and rejects oversubscription.
Quick start
After installing the CLI, the first run offers a 30-second guided setup.
Pros
- Unified management of containers and micro-VMs
- Tokens can be metered, capped, and revoked
- Multiple sandboxes can run when the hardware allows
Cons
- Non-HTTP protocols such as Postgres, Redis, and MongoDB cannot be reached through the gateway
- The default-deny network egress of Docker on macOS is only advisory