Run AI agents in Docker, on your own machine

What is a Docker computer?

Docker runs software in containers: isolated processes with their own files, network and limits, on the same machine as everything else. Rakazo uses it to give each bot computer its own container, built from a published Debian image that has a full desktop in it.

A small service called the supervisor creates, starts and removes those containers. It runs inside the Rakazo install, holds the Docker socket, and is never exposed outside it. The Rakazo API asks the supervisor for a computer; it never touches Docker directly.

This is Rakazo's own setup, not Docker's separate Docker Sandboxes product, and it isn't made or endorsed by Docker.

What Docker computers cost

Docker Engine and Rakazo are free and open source, so the cost is the machine they run on. A server costs the same whether bots work one hour a day or all day, which is the main difference from hosted sandboxes that bill by the second.

Each computer is capped at 2 GB of memory and 2 CPUs by default. Most of the time a bot's desktop is waiting on the model, so memory usually runs out before CPU does. The table assumes about 4 GB for Rakazo itself and its database, and 2 GB for each computer.

Prices in US dollars unless marked, from each provider's pricing page, checked November 2026. Your model provider bills separately. Hetzner prices exclude VAT, and its cloud plans have limited stock after two price rises in 2026. AWS price for us-east-1 on demand.

• For comparison, one 2 vCPU / 4 GB computer working 4 hours a workday costs $14.57 on E2B or Daytona, and Boat's minimum is $20. A €16.49 server runs Rakazo and several computers for less, but you look after it.
• Computers share the server's CPU. If several bots run heavy pages at once, raise RAKAZO_COMPUTER_CPUS and RAKAZO_COMPUTER_MEMORY or pick a bigger server.
• Docker Engine on Linux is free for any use. On a Mac or Windows PC, Docker Desktop is free for personal use and companies under 250 employees and $10 million revenue, and costs $9 to $24 per user a month otherwise. OrbStack is $8 per user a month for commercial use.
• You still pay your model provider, unless you run models yourself.

What a bot can do on a Docker computer

Each computer is a small Linux desktop. The bot works on it the way a person would, and you see its screen in the chat.

• Browse the web in Chromium, sign in to sites and download files. You can watch the screen live and take over the mouse and keyboard at any time.
• Run commands in a terminal, install tools and write scripts.
• Keep its work. Each bot's home folder lives on your server's disk, so files are still there after the computer or the whole server restarts.
• Share a computer with its teammates. By default, one person's bots in a space use that person's team computer, each with its own screen, and you can give a bot a private computer instead.
• Read folders you choose. An admin can mount host folders, such as a shared docs folder, into every computer, read-only unless they say otherwise.

When to choose Docker

Choose Docker when you want everything on hardware you own, with no sandbox account and no bot computers in anyone else's cloud. It is the quickest way to try a self-hosted Rakazo, and it suits a person or a team on a machine they trust.

If you'd rather keep bots off your own server, a hosted sandbox puts their computers in someone else's cloud. Boat is what Rakazo Cloud uses, and E2B pauses idle computers instead of deleting them. If you already run a cluster, Kubernetes gives you one pod per computer and lets you add gVisor or Kata for a stronger boundary. For a bot that needs your real apps and logins, see your own computer. The sandbox comparison puts every option side by side.

Limits and security

Every computer container starts with all Linux capabilities dropped and no-new-privileges set, so nothing inside can gain root powers. By default each one is capped at 2 GB of memory, 2 CPUs and 2048 processes, and each bot gets its own network that only the supervisor and screen proxy join.

• A container shares your server's kernel. It is not a virtual machine, so a kernel bug could let a process escape it. If that matters to you, use a hosted provider or Kubernetes with gVisor or Kata.
• Restricted networking gives computers the public internet but blocks your LAN, the Docker host and cloud metadata addresses. It needs Linux Docker Engine with iptables and the host rules from infra/compose/restrict-computer-egress.sh. By default the stack checks for those rules and falls back to open networking without them, so a server without the rules lets bots reach your LAN. Set SANDBOX_COMPUTER_EGRESS=restricted to refuse to start computers instead. Docker Desktop for Mac or Windows, rootless Docker and nftables hosts can't use restricted networking. The Docker computers guide has the details.
• There is no per-domain allowlist. A bot can reach any public website.
• Anyone who controls the supervisor controls Docker on that machine, which is why it stays on the internal network behind its own token.

How to set it up

These steps are for whoever runs a self-hosted Rakazo. Docker computers come with the published install, so there's no extra provider to configure, and they are set by the server's environment, not in the app's Settings. If you'd rather not run a server, the desktop app can start the same install on your Mac or PC.

1. Install Docker Engine 26 or newer with the Compose plugin on the machine that will run Rakazo.
2. Run the installer from the self-hosting guide. It writes a .env with random secrets, including the SANDBOX_SUPERVISOR_TOKEN the supervisor needs, and starts Rakazo with SANDBOX_PROVIDER=docker.
3. On Linux Docker Engine, let the installer apply the restricted-networking rules when it asks for sudo, or run sudo bash infra/compose/restrict-computer-egress.sh later.
4. Optionally change the limits with RAKAZO_COMPUTER_MEMORY, RAKAZO_COMPUTER_CPUS and RAKAZO_COMPUTER_PIDS_LIMIT, or share host folders with SANDBOX_COMPUTER_MOUNTS, as described in Docker computers.
5. Sign up, open a bot and open its computer to check that the desktop comes up.