nkzw-tech/cloudsail

Cloudsail is a tool for creating isolated remote computers (called sandboxes) that run on Cloudflare's infrastructure, intended for use with AI coding agents. When you run an AI coding assistant like OpenAI Codex, it needs to install packages, run tests, execute commands, and access GitHub. Cloudsail gives that agent its own throwaway remote environment so those operations happen in isolation from your local machine, with each task or project getting a separate workspace. The setup involves deploying a small server component to your own Cloudflare account using a command-line tool called cs. Once deployed, you can create sandboxes from the command line, seed them from a GitHub repository or pull request, open a shell inside them, and run commands remotely. You can also expose ports so that a development server running inside the sandbox becomes accessible in a browser. Sandboxes sleep after a configurable idle period (defaulting to three hours) and cost roughly $0.17 for a three-hour session on the default container size. A notable security feature is that your API keys and GitHub credentials are never visible inside the sandbox itself. They are stored in the Cloudflare Worker (the server component you deployed), and when outbound requests leave the sandbox headed for GitHub or the OpenAI API, the Worker injects the real credential at the edge. The container only sees a placeholder value. This means that even if an AI agent behaves unexpectedly inside the sandbox, it cannot read or exfiltrate your actual tokens. Outbound internet access from a sandbox is restricted by default to a set of known-safe hosts (GitHub, npm registries, OpenAI). You can add additional documentation sites per project with a single command. The project is currently in alpha and requires a Cloudflare account with several specific features enabled (Workers, Durable Objects, Containers, and Sandboxes), as well as Docker and Node 23 or newer.