I Gave My Coding Agent a Server of Its Own. Here’s How to Do It Safely

Description and use

Automated deployment and management of services by an AI agent on a dedicated server using the self‑hosted PaaS agentic‑hosting, providing sandboxing, circuit breakers, and request limits.

Problem

Deploying AI agents to production requires a platform that limits their surface area and protects the host, yet lets them build, deploy, and debug autonomously.

Outcome

Agents can autonomously deploy, debug, and manage services on a dedicated server while the host remains protected by sandboxing, circuit breakers, and strict rate limits.

Workflow

• Install Docker, gVisor, Go, and Nixpacks on a Linux server
• Configure Docker to use gVisor runtime and create a Traefik network
• Run a local registry and build the agentic-hosting binary
• Generate a master key and bootstrap token, then start the ah service
• Register a tenant via POST /v1/tenants/register to obtain an API key
• Use the API key to create a service, trigger a build from a Git repo, and provision a database
• Stream build and runtime logs to let the agent self‑debug
• Redeploy after fixes, monitoring via /v1/services/{id}/logs
• Optionally install the Claude Code skill to issue commands via chat

Evidence

agentic-hosting is a self-hosted PaaS (platform-as-a-service, like a Heroku you run yourself) whose main user is an agent talking to a REST API.

Source

Every container runs under gVisor, a sandbox that intercepts system calls before they reach the host kernel.

Source

A reconciler checks every 30 seconds that what the database thinks is running matches what Docker is actually running.

Source