For an indie developer who wants full control of their infrastructure, a coding agent stack has three parts: the agent, the sandbox it runs in, and the model. Four open-source combinations cover most needs. The first is Autopilot with Hotcell, for an agent whose sandboxes never hold your real keys. The second is a self-hosted OpenHands platform in Docker. The third is your favourite agent, such as Aider or OpenCode, inside a separate sandbox. The fourth is a fully offline stack with a local model. All of them run on a laptop, a Mac Mini or a single server, with no vendor cloud required.

Picking a single agent is the easy part. The decisions that cost indie developers money or leak their keys are where the agent runs, where the model runs, and what the agent can reach. This guide lays out each stack with what it needs and what it protects. For a broader comparison of the agents themselves, see coding agent open-source options compared. Last reviewed October 2026.

#What "full infrastructure control" means

• The agent runs on your machine, not in a vendor's cloud. Your code and conversation only go to the model you choose.
• The agent runs in a sandbox, so a bad command or a prompt injection can't touch the rest of your system.
• Your keys stay out of reach, ideally held outside the sandbox entirely, so the agent can't print or send them.
• Outbound network is limited, so a compromised agent has nowhere to send data.
• Spend has a ceiling, whether that's a cap on a key or a model that costs nothing per token.
• Nothing locks you in: open-source licences and a model you can swap.

#The four stacks at a glance

All the software is free. What you pay for is model usage, or the hardware to run a model yourself.

#Stack 1: Autopilot + Hotcell

This is our stack, built for running several agents at once without trusting any of them with your keys.

npm i -g autopilot-ai hotcell
hotcell keys add openrouter      # the real key stays on the host
autopilot                        # pick a provider on first run (OpenRouter is the default)

Autopilot is a terminal agent with plan, edit and auto modes. It runs on your own key with 25+ providers, including OpenRouter, Anthropic, OpenAI and local Ollama, and shows the cost of every turn. On OpenRouter, for larger tasks it sends read-only subagents into Hotcell sandboxes on the same machine. You can also run full agents in parallel: hotcell create -n 5 --branch auto --egress --repo ... gives five sandboxes, each with its own branch. Each sandbox gets a short-lived token, never your key, with a spend cap you choose. On Linux, egress can be default-deny at the firewall, and macOS microVMs have no network device by default.

Hardware: any Mac or Linux machine that runs Docker. Firecracker microVMs need Linux with KVM; Apple Virtualization microVMs need macOS. Trade-offs: the key swap covers HTTP APIs, not database passwords. Autopilot's main agent runs on your machine and asks before mutating commands; only its subagents are sandboxed unless you run it inside Hotcell too.

#Stack 2: OpenHands, self-hosted

OpenHands (MIT) is a full autonomous agent platform with a web UI. Run it locally and the agent works inside a Docker container that only sees what you mount. For models, use OpenRouter or any LiteLLM provider, or point it at a local server: in the advanced LLM settings, set a custom openai/ model and a base URL such as http://host.docker.internal:11434/v1 for Ollama. OpenHands' local LLM docs have the details.

Hardware: a machine that runs Docker comfortably, plus whatever your model needs. Trade-offs: your secrets are exported as environment variables inside the sandbox, so the agent can read them, and the docs don't describe default network limits. Avoid its process runtime, which has no container isolation.

#Stack 3: your favourite agent, sandboxed

If you already like Aider, OpenCode or another terminal agent, keep it and add the isolation it lacks. Neither Aider nor OpenCode sandboxes its own commands.

• Inside Hotcell: hotcell create --opencode sets up OpenCode with its model traffic going through Hotcell's gateway, so the sandbox never holds your key. Any other agent can be installed in a sandbox the same way.
• Inside agentbox (MIT): a Docker container per project with an egress policy and secrets injected by a proxy.
• Inside Docker Sandboxes: microVMs with ready-made setups for popular agents and a credential-injecting proxy. Free for local use, though Docker doesn't describe it as open source.

For the model, Aider can use a local Ollama server with export OLLAMA_API_BASE=http://127.0.0.1:11434 and aider --model ollama_chat/<model> (Aider's Ollama docs). OpenCode supports Ollama and other local providers through its provider config.

#Stack 4: fully offline

For code that must never leave your network, combine a local model with a sandbox that has no route out:

• Model: run an open-weight coding model with Ollama, llama.cpp or vLLM. In Autopilot, choose Ollama or LM Studio as the provider (AUTOPILOT_PROVIDER=ollama autopilot), or point it at another server with KIMIFLARE_BASE_URL; no API key is needed.
• Sandbox: a Hotcell Apple Virtualization microVM has no network device unless you add one. On Linux, Hotcell's enforced egress can be pointed at your local model server as a custom provider.
• Setup: download the installers, container images and model weights while you're online. Then test the whole stack with the network switched off before you rely on it.

Hardware: the model sets the bar. As a rough guide, a 30B-class model quantised to 4 bits needs about 20 GB of memory once context is included: a Mac with 32 GB or more of unified memory, or a 24 GB GPU. Smaller models run on less, but tool-calling quality drops quickly, so test on real tasks.

#How to pick

#FAQs

#Can I run a coding agent without my API keys ever touching a cloud server?

Your model key always goes to the model provider; that's how it works. What you can avoid is handing it to an agent vendor, or to the agent itself. With Autopilot and Hotcell, the key sits on your host and only travels to the provider. With a local model (stack 4), there's no key at all.

#How do I stop a runaway agent from racking up API spend?

Use three layers. Set a credit limit on the key in your provider's dashboard; OpenRouter supports this per key. Give each sandbox its own cap: Hotcell's --egress-spend-cap stops a sandbox at a fixed dollar amount, and the gateway returns an error once it's reached. And watch costs as you go: Autopilot shows the cost of every turn. A local model removes per-token cost entirely.

#Does this work air-gapped?

Stack 4 is designed for it: a local model, a sandbox without network, and everything installed in advance. Hotcell's first subagent run for Autopilot builds a cached runtime, so do that once while online. Test with the network off, since any tool that expects the internet will tell you then rather than in production.

#Do I need a GPU?

Only for stack 4, or if you want to avoid per-token costs. Stacks 1 to 3 work on an ordinary laptop with a hosted model through OpenRouter or another provider.