DevBox: an agent harness that keeps real secrets out of the sandbox

01What happened

RudderStack open-sourced DevBox on October 27, 2026 under the MIT license, in a launch post by principal engineer Fotis Xenikoudakis. DevBox takes a ticket, works out which repositories need changes, edits the code, runs tests, reviews its own diff and opens a draft pull request. RudderStack says the harness has run on its own engineering work since April 2026.

02How it works

Each task runs in its own sandbox that receives dummy values for the GitHub token and the model API key. An egress proxy named iron-proxy is the sandbox's only route out and its only name resolver, and it substitutes the real credentials as requests leave while refusing hosts that are not on the allowlist. Write access is limited to listed repositories, and out-of-scope writes are refused at the proxy rather than discouraged in the prompt. Only designated organizations and users can steer the agent through pull request comments, and that trust list is empty by default.

03Who is affected

Teams that want to run coding agents on their own infrastructure are the audience, with tasks arriving from a CLI or Linear and changes landing on GitHub. DevBox needs Docker, Bun and an OpenAI or Anthropic API key, and RudderStack recommends Kubernetes with one pod per task for production, optionally running sandboxes as Kata Containers virtual machines. RudderStack lists GitHub-only support, with no GitLab or Bitbucket, and no stable extension interface yet.

04What to do

Read the launch post's five security properties before adopting DevBox, and leave the pull request trust list empty until the set of people allowed to steer the agent is settled. Prefer the Kubernetes deployment with network-policy egress for team use, because RudderStack presents Docker Compose as a laptop trial rather than a team setup.

Sources 2 links, all fetched

1. 1rudderstack.comLaunch Post
2. 2github.comDevBox Repository