OpenHands at 1.x: How to Run It on Your Own Machine Without Handing Over the Keys

Описание и применение

OpenHands 1.x позволяет запускать автономного кода‑агента локально с изоляцией Docker, политикой подтверждения и полной записью событий, обеспечивая безопасность и контроль доступа.

Задача

Running an autonomous coding agent on a local machine without exposing code or API keys to external services.

Результат

Users can run OpenHands 1.x locally with deterministic replay, secure sandboxing, and full auditability, eliminating the need to hand over keys to external services.

Рабочий процесс

• Install Node.js and uv
• Install Agent Canvas via npm: npm install -g @openhands/agent-canvas agent-canvas
• Run Agent Canvas: agent-canvas (serves UI at http://localhost:8000)
• Configure LLM in Settings
• Create a workspace folder and open it in the UI
• Enable confirmation policy in SDK or UI
• Disable network or set sandbox network limits
• Add Docker security options (--security-opt no-new-privileges, --read-only)
• Mount secrets read‑only or via env vars
• Set LOG_ALL_EVENTS=true for audit trail
• Start conversations and monitor agent actions

Доказательства

OpenHands with a frontier model autonomously completes roughly 68% of SWE‑bench Verified tasks

Источник

The SDK ships a ConfirmRisky policy that pairs with the LLM security analyzer

Источник