- Who it helps
- Developers evaluating isolation for local coding agents
- Availability
- Apache-2.0 alpha. README requires git, tmux 3.1+ and Firecracker with Linux KVM, Apple container on Apple Silicon, or Docker.
Rules live outside the agent
A bottle defines allowed destinations and inspection rules. The gateway can attach credentials without exposing their actual values inside the agent environment.
bot-bottle alpha repository ↗bot-bottle demonstration page ↗
The security claim needs testing
The author explicitly says the security design has not had an independent review. Formats and commands may change. A configuration example and demo description establish the intended boundary, not resistance to every escape or leak.
What you can do
- Review the alpha security limitations and supported isolation backends. Open reference ↗
Where the evidence stops
README and demonstration description checked November 11. No installation, sandbox escape test, credential handling or video playback performed.
Sources read. Public source text checked November 11, 2026 UTC. No third-party project or complete workflow executed.
Sources & further reading
GitHub · implementation
bot-bottle alpha repository ↗
README checked; explicit independent-security-review gap. No sandbox executed.
diderisoft · page checked 2026-11-11
0 stars · observed 2026-11-11 18:27 UTC
Web · demonstration
bot-bottle demonstration page ↗
Configuration example and demo description read; video not played.
diderisoft · page checked 2026-11-11
Coverage note: README and demonstration description checked November 11. No installation, sandbox escape test, credential handling or video playback performed.
The record over time (1)
Dated source checks and published explanations. An observation date can differ from the original release date.
- · Added to Current
bot-bottle runs a coding agent inside a separate virtual machine or container. A gateway holds credentials and applies rules to outbound traffic.