Runtm
Open-source sandboxes where coding agents build and deploy: run Claude Code, Cursor, and other agents in isolated environments with live URLs, logs, and previews.
Credit: OS-level sandboxing (bubblewrap/seatbelt), local-only secrets with server never storing values, restricted egress by default, rate and artifact limits are concretely described. Deducted: sandbox implementation code is absent from evidence, so isolation is asserted rather than inspectable; 'yolo full permissions' is the default design stance; user confirmation appears only as one 'runtm approve --dry-run' best-practice line with no workflow detail; dependency security rests on a pinned Ruff in CI with no lock/audit story; deploy rollback path is undocumented.
Credit: CI covers lint, typecheck, and multi-package tests with real Postgres/Redis services; error behavior is tested (unknown adapter raises ValueError, unexecuted prompt returns a clear error). Deducted: mypy on two packages is continue-on-error soft-fail, weakening type guarantees; many claims remain documentation-only.
Credit: audience and scenario (developers running coding agents) are clearly stated; multi-agent support, templates, and self-hosting are explicit; command semantics are precise (start/list/attach/stop/destroy distinguish file-preserving vs destructive); platform differences documented. Deducted: capability ceilings (concurrency, scale) and Windows support are unstated.
Credit: repo structure diagram, install paths (uv/pipx/pip), quick start, and command table are complete; the split license (AGPLv3/Apache-2.0/MIT) has a dedicated explanation. Deducted: runtm/runtm-dev/runtm-api triple CLI naming is confusing; no CHANGELOG or known-limitations doc; repo-level license metadata is NOASSERTION; maintenance rests on a single named author (bus-factor risk).
Credit: deploys produce live URLs with logs/previews; the JSON-in/JSON-out agent CLI with embedded skill files improves agent usability; idle auto-stop controls cost. Deducted: deploy latency, quotas, and real cost structure are not given in-source, and benefits depend on execution (this is a static review).
Credit: core claims (secret flow, auth, rate limits) corroborate across README and SECURITY.md and are marked V0; facts and marketing are largely separated; package-level license paths are checkable. Deducted: performance claims (<100ms startup) have no supporting file and are unverifiable statically.
- Sandbox isolation and security claims come from documentation only; this review executed nothing and did not independently verify isolation strength — review the bubblewrap/seatbelt configuration yourself before use.
- The product defaults to letting agents run 'yolo' with full permissions and deploys to public URLs; confirm the approve --dry-run workflow meets your risk requirements.
- The runtm, runtm-dev, and runtm-api CLIs have different semantics; mixing them up (especially destructive commands) can cause mistakes.
- Single named maintainer, NOASSERTION repo license metadata, and no CHANGELOG; assess supply continuity before production adoption.
What does this agent do, and when should you use it?
Runtm is an open-source platform that gives AI coding agents isolated sandboxes where they can write, test, and deploy software with full permissions, without risking your machine or cloud. The repository contains a Python CLI (runtm), a Go-based Agent CLI (runtm-api), a FastAPI control plane, a build-and-deploy worker, and an OS-level sandbox runtime built on bubblewrap (Linux) or seatbelt (macOS). Local sandboxes start in under 100 milliseconds without containers and support multiple agents including Claude Code, Codex, and Gemini CLI, with sessions that can be stopped, resumed, and persisted. Deployments get live HTTPS endpoints on auto-stopping infrastructure — machines spin down when idle and wake on traffic — and runtm logs exposes build, deploy, and runtime logs. The whole platform is fully self-hostable via Docker Compose, with the server under AGPLv3, the CLI and sandbox under Apache-2.0, and templates under MIT.
runtm session start spins up an OS-level isolated sandbox (with --template web-app for templates or --agent codex to switch agents); the agent works inside with full permissions to code, install dependencies, and run tests; runtm session deploy pushes the result to a real HTTPS URL with logs and previews in one command; runtm session list/attach/stop/destroy manage the session lifecycle, with stop preserving files; runtm init/deploy/logs/status/destroy cover project setup and deployment operations. The Go runtm-api CLI drives the hosted Cloud API with JSON-in/JSON-out, stable exit codes, and embedded skill files for Claude Code, Cursor, and Codex; both CLIs share one API key. For self-hosting, clone the repo, run ./scripts/dev.sh setup, start services with docker compose, and use the runtm-dev CLI.
- Developers who want agents running with full permissions but are wary of harm to their machine use OS-level sandboxing for isolation.
- Multi-agent users juggling Claude Code, Codex, and Gemini CLI get one unified sandbox and deploy entry point.
- Prototype developers who need a shareable HTTPS URL for agent output use runtm session deploy to go live instantly.
- Engineers debugging agent builds inspect build, deploy, and runtime logs via runtm logs, then let the agent fix and redeploy.
- Teams with data or compliance needs deploy the entire control plane themselves via Docker Compose following the self-hosting guide.
- Automation pipelines driving the hosted Cloud API use the JSON-in/JSON-out runtm-api CLI with stable exit codes.
What are this agent's strengths and limitations?
- OS-level sandboxing via bubblewrap/seatbelt starts in under 100ms with no containers, keeping isolation overhead minimal.
- Works with Claude Code, Cursor, Codex, Gemini CLI and more, avoiding lock-in to a single agent vendor.
- Deployments get real HTTPS URLs on auto-stopping infrastructure, with logs and previews built in.
- Fully self-hostable, with clean per-component licensing (AGPLv3 server, Apache-2.0 CLI/sandbox, MIT templates).
- The Go runtm-api CLI is agent-first: JSON I/O, stable exit codes, and embedded skill files.
- Sandbox isolation relies on platform-specific mechanisms (bubblewrap on Linux, seatbelt on macOS); support for other platforms is not documented.
- The server components are AGPLv3, which carries compliance obligations for commercial integration and distribution.
- Full functionality (e.g. the hosted Cloud API) depends on the runtm.com hosted service and an API key, and self-hosted vs hosted tooling differs (runtm-dev vs runtm).
- The README offers no performance benchmarks, security model details, or pricing, so production readiness requires independent verification.
- The repo's license field is NOASSERTION; the multi-component licensing means adopters must verify each piece before adoption.
How do you install or deploy this agent?
Install the pip CLI with uv (recommended): uv tool install runtm; alternatives are pipx install runtm or pip install runtm. Install the Go Agent CLI (runtm-api): curl -fsSL https://runtm.com/install | bash. Self-hosting: git clone https://github.com/runtm-ai/runtm.git, cd runtm, cp infra/local.env.example .env, run ./scripts/dev.sh setup, then docker compose -f infra/docker-compose.yml up -d (use runtm-dev, not runtm, when self-hosting). The hosted Cloud API requires an API key shared by both CLIs.
How do you use this agent?
Run runtm session start to launch a local sandbox (deps auto-install on first run); customize with --template web-app or --agent codex; runtm session list shows sandboxes, runtm session attach sbx_xxx reattaches, runtm session stop preserves files; after the agent builds, runtm session deploy pushes to a live URL; runtm logs <id> shows logs, runtm status <id> checks deployment status, runtm destroy <id> tears it down. In self-hosted environments use runtm-dev instead, e.g. runtm-dev start or runtm-dev prompt "Build an API".