OpenHands at 1.x: How to Run It on Your Own Machine Without Handing Over the Keys

说明与用途

OpenHands 1.x 通过 Docker 隔离、确认策略和完整事件日志，支持本地安全运行自主编码代理，保障安全与控制。

问题

Running an autonomous coding agent on a local machine without exposing code or API keys to external services.

结果

Users can run OpenHands 1.x locally with deterministic replay, secure sandboxing, and full auditability, eliminating the need to hand over keys to external services.

工作流

• Install Node.js and uv
• Install Agent Canvas via npm: npm install -g @openhands/agent-canvas agent-canvas
• Run Agent Canvas: agent-canvas (serves UI at http://localhost:8000)
• Configure LLM in Settings
• Create a workspace folder and open it in the UI
• Enable confirmation policy in SDK or UI
• Disable network or set sandbox network limits
• Add Docker security options (--security-opt no-new-privileges, --read-only)
• Mount secrets read‑only or via env vars
• Set LOG_ALL_EVENTS=true for audit trail
• Start conversations and monitor agent actions

证据

OpenHands with a frontier model autonomously completes roughly 68% of SWE‑bench Verified tasks

来源

The SDK ships a ConfirmRisky policy that pairs with the LLM security analyzer

来源