Run Claude Code and Codex in a pinned, non‑root container.
Agentbox gives your agents a home of their own on your Mac, runs exact, checksum-verified releases of each, and mounts your projects at the same paths you already use.
Install with Homebrew
brew trust zurfyx/tap
brew install zurfyx/tap/agentboxThen, from any project, run agentbox claude or agentbox codex.
Needs macOS, Homebrew, and Docker Desktop. Apple silicon is the qualified path.
agentbox infoAgentbox: 0.1.39Launcher: /opt/homebrew/Cellar/agentbox/0.1.39/bin/agentboxManifest: /opt/homebrew/Cellar/agentbox/0.1.39/share/agentbox/release-manifest.jsonEngine: /Applications/Docker.app/Contents/Resources/bin/dockerState: absentRuntime: ghcr.io/zurfyx/agentbox-runtime@sha256:ae81c49cdf4a3104204a7ba6f240c6252b01f630f902fe7ea5401ab8395ebd4aClaude: 2.1.311Codex: 0.164.0Active: nonePrevious: nonecd ~/Code/my-projectagentbox claude- Runtime, by digest. The runtime image is pinned by its OCI index digest. Neither agent is baked into it.
- Agents, by checksum. Claude Code and Codex are pinned to exact versions, byte lengths, and SHA-256 sums, then downloaded straight from Anthropic and OpenAI on first use.
- Nothing until you launch. Installing and running
infocreate no~/.agentbox, start no container, and download nothing.
Every release is a manifest.
One Agentbox release names the runtime image and both agents down to the byte. Launches never ask alatest channel what to run, and each agent’s own updater is switched off. Only a new Agentbox release changes what you run.
| Item | Version | Platform | Bytes | SHA-256 | Source |
|---|---|---|---|---|---|
| Runtime image | 0.1.39 | linux/arm64, amd64 | Not applicable | ae81c49cdf4a3104… | ghcr.io |
| Claude Code | 2.1.311 | linux/arm64 | 293,658,808 | 2e2496c9a8065df9… | downloads.claude.ai |
| linux/amd64 | 293,776,752 | 86dc1fcc69498159… | downloads.claude.ai | ||
| Codex | 0.164.0 | linux/arm64 | 152,400,557 | 5918add6c7e9cf1e… | releases.openai.com |
| linux/amd64 | 162,338,756 | 3ec55053109608d5… | releases.openai.com |
- Runtime image 0.1.39
- linux/arm64, amd64sha256 ae81c49cdf4a3104…ghcr.io
- Claude Code 2.1.311
- linux/arm64293,658,808 bytessha256 2e2496c9a8065df9…downloads.claude.ai
- linux/amd64293,776,752 bytessha256 86dc1fcc69498159…downloads.claude.ai
- Codex 0.164.0
- linux/arm64152,400,557 bytessha256 5918add6c7e9cf1e…releases.openai.com
- linux/amd64162,338,756 bytessha256 3ec55053109608d5…releases.openai.com
Agentbox 0.1.39, as served by the Homebrew tap when this page was built. Read from the release's provenance record and release-inputs.json at153d8bb.
How a release gets onto your Mac.
The first launch prepares only the agent you asked for. Launching the other one later adds it without discarding the first or anything you’ve signed in to.
Download
Only the agent you launched, straight from Anthropic or OpenAI. Nothing vendor-made lives in the Agentbox image or archive.
Verify
Exact byte length and SHA-256 against the release manifest. A mismatch stops here.
Validate
A smoke test in a candidate container with no network, no credentials, no repository, and a read-only root.
Activate
One checksummed selector switches atomically to an immutable snapshot. Any earlier failure leaves your current release selected.
Changed your mind? agentbox rollback --accept-vendor-state-risk reselects the previous release and holds it there until you run agentbox setup --reset-selector.
Know exactly what the agent can reach.
By default an agent sees your files where they live, so tools and paths agree with your Mac. Add--workspace-only to narrow a session to the project in front of you.
| Default | --workspace-only | |
|---|---|---|
| The current project | Read/write, same path | Read/write, same path |
| /Users and /Volumes | Read/write | Not mounted |
| /tmp | The host’s, read/write | Private, session-only |
| Agent home, ~/.agentbox | Read/write | Read/write, .ssh hidden |
| Pinned agents and runtime | Read-only | Read-only |
| GitHub token from gh | Passed in when gh is signed in | Withheld |
| OPENAI_API_KEY | Codex sessions only | Codex sessions only |
| onhost, a shell on your Mac | If you set it up | Unavailable |
| Network | On | On |
It isn’t a sandbox.
Agentbox separates your agents’ identity and pins the bytes they run. In either mode an agent can still change or send anything it can see, use its credentials, and reach the network. clauded andcodex also skip the agents’ own prompts. Treat repositories, hooks, and tool output as able to affect your Mac.
Commands
setup and doctor exist, but neither is a step you need before the first launch. The usage guide covers everything else.
agentbox claude- Claude Code, also the default when you run agentbox alone. Extra arguments pass straight through.
agentbox codex- Codex, with its approvals and sandbox bypassed.
agentbox clauded- Claude Code with permission prompts skipped.
agentbox --workspace-only …- Mount only the current project for this session.
agentbox --no-update …- Launch the release already selected, without preparing a newer one.
agentbox codex login --device-auth- Sign Codex in with a device code. Browser callback login isn’t supported.
agentbox update- Upgrade through Homebrew, then prepare the new release.
agentbox rollback --accept-vendor-state-risk- Reselect the previous release. The agents’ own state isn’t reverted.
agentbox info- Show installed and selected releases. Reads only.
agentbox doctor- Check integrity and the Docker engine. Never repairs or runs vendor code.
Try it on the project you have open.
Two commands, then agentbox claude
brew trust zurfyx/tap
brew install zurfyx/tap/agentbox