I've been building [OpenRig](https://github.com/EliasOenal/OpenRig) to solve a problem that kept bugging me: I wanted agents that won't leak your company data. Giving them real shell access on infrastructure where multiple users share the system, without one compromised session being able to leak data or nuke a colleague's work.

The core idea: every agent session runs in its own firejail sandbox with a private filesystem, network namespace, seccomp filters, and dropped capabilities. The sandbox is the security boundary, not the LLM. The model runs shell commands freely inside the box, and the OS enforces the walls.

**How the sandboxing actually works:**

* **Per-user Unix accounts**. Each application user maps to a dedicated Unix user (nologin). Home directories, file ownership, process ownership are kernel-separated. No shared service accounts.
* **Per-session firejail jails**. Every chat session spawns its own jail: private tmpfs home, isolated network namespace on a bridge, all capabilities dropped, seccomp filtering, dbus/device/sound/video blocked, sensitive host paths blacklisted. Cgroup v2 resource limits (memory, CPU, PIDs) enforced per-user across all their sessions.
* **Network segmentation via iptables**. Default policy is *intranet*: agents can reach RFC 1918 subnets (your internal systems) but the public internet is DROP'd. Can also be set to *none* (total isolation) or *internet* (full NAT). Optional DNS filtering via dnsmasq closes the exfiltration-via-DNS-query loophole. Only allowlisted domains resolve; everything else gets NXDOMAIN.

A privileged supervisor daemon spawns sandboxes as the target UID. The web process itself runs unprivileged. The supervisor authenticates connections via *SO\_PEERCRED*.

**Other highlights:**

* Works with any OpenAI-compatible API. Tested with vLLM and llama.cpp. No telemetry, no external calls beyond your inference endpoint.
* **Skills system**. Ships with terminal, browser automation (agent-browser), and more. Users can add their own skills, along with custom binaries and scripts.
* **Per-user credentials**. API keys and service tokens scoped to each user's sessions. Not a shared key ring.
* **Cronjobs**. Run agents on a schedule (30m / hourly / daily / weekly) for unattended recurring tasks.
* **Web UI** with admin panel, file manager, session monitoring, real-time streaming via SSE.
* **Matrix/Element** integration under active development. Agents accessible via chat threads, each backed by an isolated session. **Slack** **connector** planned.
* **LDAP/AD** support with auto-provisioning on first login and group-to-admin mapping. OAuth2 planned.
* **BSD license**.

Single privileged **Docker** container on any Linux host with cgroup v2. The image ships a comprehensive agent toolchain (ripgrep, jq, pandoc, LibreOffice \[headless\], tesseract, numpy/pandas, [term-cli](https://github.com/EliasOenal/term-cli), and more)

GitHub: [https://github.com/EliasOenal/OpenRig](https://github.com/EliasOenal/OpenRig)

The goal is for OpenRig to gain further autonomy (think corporate version of OpenClaw) without ever compromising security. Happy to answer questions about the architecture.

OpenRig - multi-user agent runtime with strong sandboxing (BSD license)