Most coding agents run directly on your host machine. Every command,
every file write, every package install happens in your actual environment.
One hallucinated rm -rf and it's your system that pays.
OpenMono takes a fundamentally different approach.
Star on GitHubWhen you launch OpenMono, the agent is confined to a Docker container. It doesn't live in your terminal or your shell — it's a separate, isolated process with its own filesystem and its own network stack.
The container has its own filesystem root. There is no path the agent can write that reaches your home directory, your SSH keys, or any other project — the namespace boundary is enforced by the kernel.
If the agent makes a mistake or trashes a config file mid-task, it happens inside a container. Stop it, start fresh. The damage stays inside the box.
The only mount into the container is your project directory — mapped to /workspace. Everything else on your machine is not mounted, not accessible, and not a risk.
We mount your project directory into the container at /workspace.
This gives the agent the surgical access it needs — read code, write files, execute builds —
but nothing more.
The agent image comes pre-baked with the entire toolchain — the .NET runtime, git, ripgrep, Python, and the MCP servers for deep code analysis. You don't install any of it. It all lives inside the image.
The agent talks to the LLM — running in its own llama.cpp container — over a private, internal Docker network. No internet exposure, no LAN access. It's a closed channel that only exists while the playbook is active.
The agent container has no route to the public internet. It cannot exfiltrate your code, call external APIs, or phone home. The network stack doesn't reach the WAN.
Your internal network — other machines, NAS drives, office servers — is equally invisible. The Docker network is a private overlay that spans exactly two containers.
The network only exists while the containers are running. When the playbook completes, the network tears down. There is no persistent socket, no daemon, no residual exposure.
The industry calls this YOLO mode. The reality is that hard isolation is the only thing that makes autonomous agents viable.
Local inference, scoped filesystem access, and network isolation. Install once and the agent works unsupervised — in a box it cannot escape.