OpenHands at 1.x: How to Run It on Your Own Machine Without Handing Over the Keys

Description and use

OpenHands 1.x enables local autonomous coding agent execution with Docker isolation, confirmation policies, and full event logging, ensuring security and control.

Problem

Running an autonomous coding agent on a local machine without exposing code or API keys to external services.

Outcome

Users can run OpenHands 1.x locally with deterministic replay, secure sandboxing, and full auditability, eliminating the need to hand over keys to external services.

Workflow

• Install Node.js and uv
• Install Agent Canvas via npm: npm install -g @openhands/agent-canvas agent-canvas
• Run Agent Canvas: agent-canvas (serves UI at http://localhost:8000)
• Configure LLM in Settings
• Create a workspace folder and open it in the UI
• Enable confirmation policy in SDK or UI
• Disable network or set sandbox network limits
• Add Docker security options (--security-opt no-new-privileges, --read-only)
• Mount secrets read‑only or via env vars
• Set LOG_ALL_EVENTS=true for audit trail
• Start conversations and monitor agent actions

Evidence

OpenHands with a frontier model autonomously completes roughly 68% of SWE‑bench Verified tasks

Source

The SDK ships a ConfirmRisky policy that pairs with the LLM security analyzer

Source