v0.7.1-beta.2 is out · 22 Octsee the release

SECURITY / SELF-HOSTED

Know the boundaries.

Your server runs the agents. Docker contains the work. Neither makes an agent harmless: what you mount, connect and authorize determines what it can reach.

Read the security posture

EXECUTION BOUNDARY

What runs where

Your computer controls the work, but your server holds the execution environment and persistent state.

Read the execution boundaries
Your computer
The CLI and local dashboard control your local checkout. Dashboard requests reach your server over SSH.
Your server
Repositories, run records and member homes live on the machine you or your team operate. It opens terminals only inside containers, never on the host.
Docker containers
The agent and tools run with the run checkout and the launcher's member home mounted, using the credentials and network they can reach. The run's browser has a container of its own.
External providers
The agent talks to its model provider. Authorized tools reach services such as GitHub using your account.

NETWORK EXPOSURE

Choose your connection path

SSH defaults to port 2222, carrying control, Git, events, terminals and dashboard forwarding over one connection. You choose how to make it reachable; Tailscale is recommended.

Read the networking guide

  • OPTIONAL / EDGE

    Relay without inbound ports

    Without direct reachability, client and server can both dial out to an edge. GitHub sign-in enables relayed SSH without Tailscale or an inbound server port for that path. Server setup turns the project's edge on when the host has no tailscaled, and prints what the edge sees and how to turn it off.

    Edge connection details

DASHBOARD LISTENERS

No HTTP unless you set web-port

The server opens no HTTP port unless you set web-port, and that one listens on the host's tailnet addresses only.

  • LOCAL GUI

    Loopback on your computer

    The local GUI binds 127.0.0.1 and nothing else, on your own computer. Every request needs its per-process bearer token, loopback included, and it reaches your server over SSH. It adds no dashboard listener to your server.

    Local gateway details

  • OPTIONAL / WEB-PORT

    HTTPS on your tailnet

    The web-port setting is off by default; enabling it serves the dashboard over HTTPS on the server's tailnet addresses. Tailscale identifies each request, independently of the local GUI.

    Server dashboard details

OPTIONAL EDGE / METADATA

What the relay sees

The publisher-operated edge stores account identity, device, claimed-server and server-directory records when you use it. While relaying, it sees your IP address, destination server, connection timing and byte counts.

Privacy policy and retention

  • END-TO-END ENCRYPTION

    Session content stays encrypted

    Terminal, agent, file and dashboard session content travels inside SSH, encrypted end to end between your computer and server, so the edge cannot read it. Encryption does not hide connection metadata from the relay.

    Read the encryption boundary

  • HOSTING STATUS

    Hosting is not launched

    There is no hosted Aether workspace. The protocol reserves a kind for one, and nothing produces it. The optional edge exists today, but your workspace still runs on your own server.

    Deployment trust models

ISOLATION LIMITS

Root inside the container

Agents run as root by default with Docker's default capabilities, no second sandbox and no forced read-only root filesystem. Treat root as able to read or change anything the container can reach, and review mounts, network access and credential scopes.

The server opens terminals only inside containers, never on the host, and never mounts the Docker socket into a workspace container.

Isolation and mount policy

  • DOCKER INSIDE RUNS / SYSBOX

    A daemon of its own, or none

    With Sysbox installed, each run starts its own Docker daemon in a user namespace, so root in the container maps to an unprivileged user on the host. The container is not privileged and never gets the host's Docker socket. Without Sysbox a run has no daemon and no socket.

    Docker inside a run

  • REVIEW BEFORE MERGE

    Nothing lands on its own

    Every run works on its own branch and ends there. Aether never switches your branches or merges a run into your base branch: you read the diff, then push it and open a pull request, or pull it into your clone. Publishing never force-pushes.

    Reviewing a run

  • PERMISSION PROMPTS

    Agents do not stop to ask

    By default an agent runs without asking for permission, in every mode. In an Enhanced run of Claude Code or Codex you can switch the session to a mode that asks. The container is the boundary, not a prompt.

    Standard and Enhanced runs

  • OPERATOR RESPONSIBILITY

    The host is trusted

    The container does not protect workspace data from server administrators, and a separate run checkout does not make its mounted member home private. Homes and backups carry credentials: restrict access and encrypt backups.

    Read the operator trust modelWhat lives in the data directory

BROWSER COMPANION

A browser kept apart from your files

Each run can open a headless Chromium that its agent drives and your team can watch. It runs in a companion container of its own, joined to the run's network so it reaches the app the agent started, and to nothing else of the run.

It shares the run's network reach, and a page can hold cookies or customer data: use test accounts, not production logins.

Browser isolation

  • HARDENED CONTAINER

    No checkout, home or credentials

    It runs as UID 1000 with a read-only root filesystem, every capability dropped and no-new-privileges, and Chromium keeps its own sandbox. Its only mount is a private control directory: never the checkout, a member home, signing keys, agent logins or the Docker socket.

    The companion's policy

  • NO DEBUGGING PORT

    Commands over a pipe

    Playwright drives Chromium through a debugging pipe, not a CDP port. The server passes typed commands and frames over a Unix socket, and no client gets raw CDP access.

    How the browser is driven

  • STEER REQUIRED

    Viewers cannot watch it

    Watching or driving a run's browser needs Steer, the permission to message that run, because the page may be signed in to something. Permission to view the run is not enough.

    Who may open the browser

CREDENTIALS / SERVER-SIDE LOGIN

Sign in on your server

Complete the provider's native login in your server-side environment terminal. Login state persists in your member home, mounted read-write into that terminal and every run you launch, and into no one else's containers, unless you share your agent account, which lends only that agent's login.

Aether does not copy vendor credentials to clients or synchronize them.

Member home and login details

  • GITHUB CREDENTIALS

    Plaintext tokens need care

    Connecting GitHub stores a plaintext gh token and a signing private key in the member home. Container root can read or replace both; the token's scopes define its reach.

    Token and signing-key risks

  • CONFIGURATION IMPORT

    Scanned before and after upload

    Configuration import is separate from login: known credential names are left out, the CLI runs the server's secret scanner before sending and never sends a flagged file, and the server scans every file again. The scanner finds known patterns, not every secret, so do not assume an arbitrary secret stays on your computer.

    Read the import policy

Outbound services and reporting

What leaves the server

  • MODEL + SERVICE APIS

    Self-hosted does not mean offline

    Agents send requests to their model providers. Connected tools and package installers make their own service requests.

    Review agent network access

  • SUBSCRIPTION QUOTA REPORTING

    Usage checks run server-side

    Quota reporting reads Claude or Codex login state from the member home and sends bearer tokens to fixed vendor HTTPS usage endpoints. Those tokens are not sent to the browser.

    Quota access policy

  • RELEASES + CONTAINER IMAGES

    Updates are signed

    Release checks ask GitHub for the newest release, and updates download its assets. Every updater checks them against the release's signed manifest before installing anything. Missing published container images can be pulled from GHCR.

    Release signing

OPEN SOURCE / GPL-3.0

Inspect the source yourself

Aether is licensed under GNU GPL version 3; bundled dependencies retain their own licenses. These references describe release v0.7.0-alpha.16.

Read the license notices