agentic-ci

Run AI coding agents in sandboxed CI environments with streaming output and telemetry. Supports multiple agent harnesses (Claude Code, OpenCode, and Codex) and isolation backends so you can choose the right tradeoff between simplicity and security.

Backends

Local

Runs the agent directly in the current environment with no container or sandbox layer. The agent binary must already be installed and on PATH. Environment variables (auth, OTEL, model) are set automatically by the harness.

Good for: running inside an existing CI container (e.g. a Prow step image) where the agent CLI is pre-installed and an extra isolation layer is unnecessary.

Requires: the selected agent CLI on PATH (for example claude, opencode, or codex).

Podman (default)

Runs the agent inside a Podman container. Each run creates a fresh container that auto-deletes on exit. The work directory is mounted into the container and gcloud credentials are mounted read-only.

Important: The Podman backend provides only basic container-level isolation. It uses --network host, so the agent has unrestricted network access. There is no filesystem sandboxing beyond the container boundary itself and no network policy enforcement. Use the OpenShell backend if you need stronger security controls.

Good for: local development, CI runners that already have Podman, quick one-off runs in trusted environments.

Requires: podman, a container image with the agent CLI installed (e.g. ghcr.io/opendatahub-io/ai-helpers:latest).

OpenShell

Runs the agent inside an OpenShell sandbox with network policy enforcement, Landlock-based filesystem access control, and fine-grained endpoint restrictions. Network policies limit which hosts the agent can reach (e.g. only Vertex AI, GitHub, PyPI) and filesystem policies restrict which paths are writable. An embedded gateway starts per CI job — no external infrastructure required.

Good for: production CI where you need to control what the agent can access on the network and filesystem.

Requires: openshell and openshell-gateway installed on the host. See Local Development with OpenShell