Open Terminal
A lightweight, self-hosted terminal that AI agents and automation tools can access via a simple REST API.
- Source repo
- open-webui/open-terminal
- Stars
- ★ 3.4k
- Last updated
- today
- License
- MIT
- Primary language
- Python
- FA score
- 50/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platform
- Cost
- Free, no paid service needed
- Setup effort
- Low · running in minutes
- You'll need
- Typical use
- An AI developer runs Open Terminal locally to give an agent direct access to project files and command execution for code testing and debugging.
- Not a fit if
- Teams needing production-grade multi-user isolation; single-container mode has no hard boundaries
- OpenShift users who need runtime package installs or Docker socket access
- Anyone unwilling to grant host-level access; bare metal runs with your user's permissions
- Source review
- 50/100 · Major gaps 2 safety controls not found
What does this agent do, and when should you use it?
Open Terminal is a lightweight, self-hosted terminal server that provides a dedicated environment for AI agents and automation tools to run commands, manage files, and execute code. It is accessible through a simple REST API and can be deployed either with Docker (sandboxed) or on bare metal via pip. The Docker image comes in several variants, including a full-featured image with a complete toolkit and slim/alpine variants for smaller footprints. It integrates with Open WebUI, enabling AI assistants to execute commands and manage files directly from the interface. The project is licensed under MIT.
Open Terminal exposes REST API endpoints for executing commands, managing files, and browsing directories. It receives commands via endpoints like /exec, runs them on the server, and returns the output. It supports file upload, download, edit, and delete operations, as well as retrieving the current working directory and file listings. It can be customized using environment variables such as OPEN_TERMINAL_PACKAGES, OPEN_TERMINAL_PIP_PACKAGES, and OPEN_TERMINAL_NPM_PACKAGES to install extra packages at startup. In Docker mode, it provides an isolated environment; in bare-metal mode, commands run directly on the host with the user's permissions. It also supports a multi-user mode where each user gets a dedicated Linux account and home directory.
- An AI developer runs Open Terminal locally to give an agent direct access to project files and command execution for code testing and debugging.
- A system administrator deploys Open Terminal on a server to provide a remote execution environment for automation scripts without exposing SSH.
- A team integrates Open Terminal with Open WebUI so members can browse, upload, and edit files through the interface while AI assistants perform operational tasks.
- A security researcher uses the Docker sandbox to safely execute untrusted code in an isolated environment separate from the host.
- A CI system calls Open Terminal's API to run build and test steps inside a container.
- An educator sets up an Open Terminal instance for students to practice Linux commands without requiring local VMs.
How do you install or deploy this agent?
To install with Docker, run: docker run -d --name open-terminal --restart unless-stopped -p 8000:8000 -v open-terminal:/home/user -e OPEN_TERMINAL_API_KEY=your-secret-key ghcr.io/open-webui/open-terminal. Image variants include latest, slim, alpine, and openshift. For bare metal, install via pip: pip install open-terminal, then run open-terminal run --host 0.0.0.0 --port 8000 --api-key your-secret-key.
How do you use this agent?
After starting, interactive API documentation is available at http://localhost:8000/docs. Authenticate with the API key. Customize the environment using environment variables, e.g., OPEN_TERMINAL_PACKAGES="cowsay figlet". In Open WebUI, add an Open Terminal connection via user settings or admin settings, providing the URL and API key. To use the API, invoke the /exec endpoint to run commands and /files endpoints to manage files.
What are this agent's strengths and limitations?
- Offers multiple Docker image variants, from full toolkit to minimal footprint, catering to different scenarios.
- Supports installing apt, pip, and npm packages at startup via environment variables, avoiding image forks.
- Deep integration with Open WebUI, including a file browser sidebar and user/group-level access control.
- Includes built-in multi-user isolation with dedicated accounts and home directories per user.
- API-key authentication and can run as a standalone service.
- Bare-metal mode directly exposes host permissions, posing security risks if misused.
- Multi-user mode's production security is limited, not suitable for large or untrusted deployments.
- Slim and alpine variants do not support runtime package installation; custom images are needed.
- OpenShift image is feature-restricted, lacking runtime installs, Docker socket access, and egress firewall.
- Automatic API key generation when not set requires checking container logs, which may be inconvenient.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| Open Terminal This agent | 50 · Major gaps | Self-hosted serviceFree | ★ 3.4k | today | Python | — |
| Judge0 Online Code Execution System | 41 · Major gaps | Self-hosted serviceFreemium | ★ 4.5k | 1d ago | HTML | — |
| Memanto | 50 · Major gaps | CLIFreemium | ★ 2.3k | 1d ago | Python | Codex · Claude Code |
| Cheshire Cat AI | 47 · Major gaps | CLIFree | ★ 3.1k | 2mo ago | Python | — |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows: README explicitly warns about Docker socket mounting and bare-metal risks, offers multi-user isolation option, but lacks user confirmation mechanism or rollback plan. API key configured via environment variable, but no details on key storage and transport security. Dependency version ranges are loose, no lock file or vulnerability scanning evidence. External effects (e.g., Docker socket) are warned but not enforced. Source attribution: author and license clear, but publisher unverified. Deductions: missing user confirmation, rollback, dependency security details.
Evidence shows: README and configuration docs are consistent, Docker image variants clearly explained, dependency list complete. But no error message examples or troubleshooting guide. Deduction: failure messages not explicit.
Evidence shows: Clearly targets AI agents and automation tools, offers Docker and bare-metal deployment, multiple image variants, flexible configuration. Capability boundaries (e.g., file browser root) are described, but terminal commands not restricted. Trigger precision: controlled via API key and config, but no fine-grained permissions. Environment fit: supports multi-platform and OpenShift. Deductions: capability boundaries and trigger precision could be more explicit.
Evidence shows: README structure clear, install notes detailed, naming stable (open-terminal), examples and FAQ provided (via README tips), known limitations (e.g., multi-user mode warning) documented, MIT license, version in pyproject.toml, CHANGELOG and release workflow present. Maintenance responsibility: author clear, but publisher unverified. Deduction: maintenance responsibility based only on author info.
Evidence shows: Output is REST API, interactive API docs provided, easy to use. Marginal value: provides remote terminal for AI agents, unique value. Cost-benefit: Docker image large, but slim variant available. Deduction: no performance or resource usage data.
Evidence shows: README claims (e.g., features, image sizes) align with code and config, but no test results or independent verification. Deduction: lack of test evidence and independent sources.
- Not found in source: confirmation before actingTurn on (or add) a confirmation step before it acts, and try it in a sandbox or test environment before real data.
- Not found in source: rollback or recovery pathBack up first, or work on a git branch or snapshot, so its changes can be undone.
- Publisher unverified, identity unknown, assess supply chain risk carefully.
- Docker socket mounting and bare-metal operation are high-risk, use only in fully trusted environments.
- Dependency version ranges are loose, no lock file or vulnerability scanning, recommend self-audit.
- Multi-user mode not for production, lacks hard isolation.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
Fixed - Reduced memory use when reading and editing large text files. Reading just a few lines no longer loads every line into memory, which could previously crash the server even for a small response. - Reduced memory use when reading text from documents, uploading and viewing files, downloading folders as ZIP files, and previewing Word and PowerPoint files as PDFs. Temporary files are removed after sending or cancellation. …View on GitHub ↗ -
Release notes excerpt
Added - Command results now include the folder the command ran in, so assistants can see where each command started without running a separate command to check. Fixed - Fixed file browsing in Open WebUI when Open Terminal runs directly on Windows. Opening a folder previously failed with a server error while checking whether its files could be edited.View on GitHub ↗ -
Release notes excerpt
Fixed - Apps connecting to the MCP server over the network must now provide your Open Terminal API key. Previously, they could run commands and access files without providing the key. Connections with a missing or incorrect key are now rejected. If you had the MCP server enabled for network connections, update to the latest release.View on GitHub ↗
FAQ
Does Open Terminal support multiple users concurrently?
OPEN_TERMINAL_MULTI_USER=true to enable multi-user mode; each user gets a dedicated Linux account and home directory. However, this isolation is based on Unix permissions and does not provide hard isolation boundaries, so it is not suitable for production.How can I add extra packages?
OPEN_TERMINAL_PACKAGES, OPEN_TERMINAL_PIP_PACKAGES, and OPEN_TERMINAL_NPM_PACKAGES environment variables to install packages at startup. For slim and alpine variants, you need to build a custom image.Does it support file upload and download?
Can Open Terminal run without Docker?
pip install open-terminal and run it on bare metal. Note that in bare-metal mode, commands run directly with your user's permissions without sandboxing.