Capabilities

Images and buildsCopy Anchor Link

Use a published image or build from a Containerfile. A build context is copied into the machine and built there, so build instructions never execute on the host. The context is discarded after the build.

SecretsCopy Anchor Link

Declare only the names a cell needs:

secrets:
  CLAUDE_API_KEY:
  GITHUB_TOKEN:
    required: false
    description: pushing branches and opening pull requests

Values are kept on the host. up asks for missing values, and the secrets command can set or rotate them later. A name is required unless it says otherwise, so a cell will not start without it; required: false marks one the cell can work without.

PortsCopy Anchor Link

Ports are the way into a cell. Omit ports to forward every listening port to host localhost, or list only the ports a cell should expose:

ports:
  - 8080
  - 3000

Network egressCopy Anchor Link

An allow list turns network access into a default-deny policy:

network:
  allow:
    - github.com
    - api.anthropic.com
    - registry.npmjs.org

Domains, IPv4 addresses, and IPv4 CIDR blocks are supported; restricted and VPN-only cells drop non-loopback IPv6 traffic, so IPv6 policy entries are refused when the cell is read. Custom resolvers can be configured for corporate or split-horizon networks. A WireGuard configuration can route the cell's traffic through a separate exit.

ArtifactsCopy Anchor Link

Inside the cell, publish regular files with artifact. On the host, fetch copies published files without making the cell's filesystem visible. send places selected host files in the cell's inbox. Transfers are explicit, repeatable, and validated rather than mounts.

DashboardCopy Anchor Link

The dashboard is a live view over the same lifecycle operations as the CLI. It shows state, resources, network permissions, tunnel health, and secret presence without displaying secret values. It can also follow DNS and firewall events to explain an egress decision. See the dashboard.

Build contexts stay inside the cell directory. Symlinks are skipped and common credential names are excluded: .env, .env.*, *.env, *.env.*, *.pem, *.key, *.kubeconfig, id_*, credentials, credentials.json, vpn.conf, .ssh, .aws, .gnupg and .kube. Files ending in .example or .sample are allowed unless their name starts with .env.. The configured VPN file is also excluded even when it has another name. Arbitrary filenames can still contain secrets; review everything else in the context before building.