Solitary

Overview

Understand solitary before you run it.

Solitary runs coding agents in hypervisor-isolated cells. A cell is a Lima virtual machine with a container inside it: the VM is the security boundary, while the container is the replaceable toolset.

These docs explain the problem, the model, and the capabilities. The project is on its 0.x line, so the shape of a cell's configuration can still change between releases.

Start here

Operate a cell

Guides

What you can do

  • Run an agent without mounting your repository into its environment.
  • Replace the container image without replacing the cell's persistent VM disk.
  • Pass only named secrets to the cells that need them.
  • Control which ports reach the host and which domains the cell can reach.
  • Send inputs in and fetch published artifacts out through explicit host commands.
  • Route everything a cell reaches through a WireGuard tunnel, with no fallback when it is down.
  • Watch every name a cell looks up and every connection it was refused, in a live dashboard.
  • Throw away a cell and recreate it without losing its host-held secrets.
  • Share the environment definition while keeping credentials and VPN files local.

Important boundary

Isolation protects the host from a compromised cell. It does not make an agent harmless: it can still misuse any token, network destination, image, or other authority you grant it. Read the security model and what solitary does not protect against before trusting it with credentials.

On this page