So I’ll preface this by saying that this is a bit of a shill post, which for me is unfortunate since I’ve been lurking in Level1 sphere for a while (daily driving Looking Glass, trying to extend it with DPDK to 7km over 200gbps dark fiber, massive hpc homelab rack, etc etc.) and this is what my first post is.. Hi!
(In my defense the project is OSS, I just want it to succeed at least mildly and ideally find long-term maintainers, I have other companies to run..)
Aaanyways, I’ve been seeing Wendell talk about.. things (harnesses? sandboxes? meta-harnesses??) where the idea is that agents write code and can modify the harness itself from within itself. The likes of the new Deepseek thing, Intel SuperClaw etc.
I’ve been thinking about this problem too, and coming from more of a systems background those approaches do feel to me a bit ‘upside down‘. When you’re building an IT infra for anything more or less serious, everything is about boundaries and permissions. Most data processing systems and automations can be just rigid code and don’t need the vagueness of LLMs (and certainly can’t deal with the cost of LLMs..) this applies all the way from internal company transaction processing systems to Home Assistant dashboards.
So we have those magical things able to conjure up generally working code, Codex/Claude/OpenCode/Pi/etc. etc. but how do you deploy 100 mini apps and manage dependencies between each one? I have a pretty bigly Proxmox cluster with 416 vcpus and terabytes of ram, but I’m not going to put each 1k-10k LOC slop app in its own CT/VM. Kubernetes? Eh maaybe, but try to manage a massive mesh of 100s of dependant apps. It’s possible but you’re now a full time k8s admin for what should have been a fairly simple homelab, and you still have multi-minute iteration cycles.
What I really wanted is something that:
- Allows AI Coding agents to really quickly create useful apps
- Can scale to millions of ‘slop‘ LOC without feeling like you’re running at enterprise IT datacenter
- Is reasonably secure by default (ahh the 20+ slop localhost deamons for ‘its just my finances‘ app with no XSS guards)
- Is sandboxed vs sloppy agents messing things up by accident (namespace-based sandboxing, not runc/docker/podman/etc full containers)
- Has some multi-user-ness (allow your team/family members to create their apps and connect to other apps without being able to break/see everything)
- Most importantly, to coding agents it feels like any other web-app, which is most of what LLMs are trained on, in-distribution tasks = high quality output with little effort
Important caveat: this is not a general sandbox you can e.g. do your programming work for a job, that was a non-goal, the goal was enabling custom workflows that, in a company, would be managed by an IT department in an in-house datacenter.
This is how https://xbin.dev/ came to be. It may or may not be the solution to the self-modifying sandboxes feeling like toys, maybe yall like it.
What I’ve used it for successfully so far:
- Building itself
- Deep communication organisation (imap, slack etc. connectors, auto task recognition)
- Invoice processing
- Automatic Paperless doc labeling (local AI for all that ofc.)
- Company payment reconciliation
- Bank account insights (Lunchflow is great for EU bank access btw!)
- Flagging unpaid invoices + proposing batch payment .CSVs
- Company infra health canaries (soo many, that alone is ~50 ‘apps’)
- Automated/programable todo-lists and calendars (maintenance schedules etc.)
- Company dashboards (plugging into our systems, Hubspot, Stripe..)
- Markets apps (ticker system, market connectors, portfolio/finance overview..)
- MCP connectors for everything (separate apps), custom agents for bunch of the above
- Complex Home Assistant automations
- Home Assistant MCP + proposal guard for creating HA Automations/Scenes/Scripts with LLM Agents
- Custom IoT dashboards for HA serving to Shelly Wall Displays (so much better than stock HA dash..)
What you may notice is that everything generally falls into either ‘somewhat sensitive‘ and ‘really sensitive‘ categories. Normally you wouldn’t let AI agents, even local ones near this stuff - the way I’ve addressed that is by having ‘code’ and ‘runtime‘ sandboxes be 100% separate and just having the coding agent see a proxied (and disconnectable) API access to the app backend its writing. Each app has a sandboxed encrypted filesystem (if they request that, by default app filesystem view is fully read-only; fs encryption is done through a built-in in-memory vault system), apps must explicitly request grants for everything including internet access, access to other app APIs etc; Networking itself is also pretty interesting because by default you can filter apps to only allow egress to internet (gvisor userspace proxy) meaning rouge apps can’t scan your LAN/host. Also you can create apps which provide networking to other apps, meaning you can create VPN/Proxy/traffic analysis apps for whatever you’d need those for.
This got long..
- LMK if you like this architecture or what you’d do differently
- Try XBin (it’s super easy to selfhost, supports rootless namespaces)
- Do you use anything else to ship millions of lines of vibecoded helper programs that make your life easier?
- (in general) Thoughts on how sharing pre-built ‘building blocks‘ apps should work - stuff like MCP connectors need to exist, but is it easier if everyone prompts their own into existence, or should there be a way to discover and use ones that others have built?