Your Code Agent Needs Its Own Machine

Giving an LLM root access to your laptop in auto mode doesn't sit right with you either? Good. Neither does "we vetted the model's alignment" — because alignment doesn't stop rm -rf / on a command you approved in the wrong terminal.

Jake Saunders got tired of the trust game. So he built the alternative: a fully self-hosted, sandboxed, agentic software factory. From one prompt, his agent created a repo, wrote the application and tests, got CI green, provisioned Postgres, and deployed the finished app behind HTTPS — without another message from him. The only recurring cost: a £20 Codex subscription.

The architecture is worth zooming in on, because the decisions reveal how agentic development needs to evolve.

The Stack

This isn't a toy MCP playground. Jake wired up:

• Coolify — self-hosted Heroku-on-Docker as the PaaS layer
• Forgejo — self-hosted Git + CI runners (no GitHub tokens in the blast radius)
• Hermes — the agent harness, using Codex for inference
• Firecrawl — self-hosted web scraping for agent research
• Pi-hole + Tailscale — DNS routing and tailnet access
• Porkbun + Let's Encrypt (DNS-01) — SSL for unreachable services

The two-server setup is the key decision. A 2014 dual-core i3 runs the blog, Pi-hole, and the observability stack. A 2021 10th-gen i7 with 32GB RAM — bought fresh from eBay — is the sacrificial agent box. No port forwarding, no external ingress.

The DNS-01 Trick That Makes It Work

Here's the clever part. If the agent box has no ingress, how does it serve your apps? And how do they get SSL certificates without public DNS records?

Pi-hole resolves *.internal.jakeshomelab.me to the agent box's LAN IP. Traefik (via Coolify) uses DNS-01 challenges with Porkbun's API: it creates a TXT record at _acme-challenge.my-service.internal.jakeshomelab.me, Let's Encrypt validates it, Traefik deletes it. The result is a valid HTTPS URL reachable inside the tailnet with no public A or AAAA record pointing to the service.

graph TD
  A[Single Prompt] --> B[Hermes Agent]
  B --> C[Forgejo: Repo + CI]
  C --> D[Code: SvelteKit + Drizzle + Postgres]
  D --> E[CI: Tests Must Pass]
  E --> F[Coolify: Docker Deploy]
  F --> G[DNS-01 via Porkbun]
  G --> H[HTTPS at calories.internal.jakeshomelab.me]
  H --> I[Accessible via Tailscale only]
  style A fill:#a78bfa,color:#0a0a0b
  style H fill:#a78bfa,color:#0a0a0b
  style I fill:#f87171,color:#0a0a0b

What It Actually Did

The prompt was: "Build me a calorie tracking app like MyFitnessPal with custom food forms and meal quick-select. Full-stack SvelteKit, Drizzle, Postgres, Tailwind, mobile-first. Deploy to http://calories.internal.jakeshomelab.me with Docker Compose and its own Postgres instance."

The agent then:

1. Created a new Git repo and bootstrapped SvelteKit + Drizzle + Postgres + Tailwind
2. Wrote the application and tests in sensible commits
3. Created a CI pipeline
4. Worked through test failures until CI turned green
5. Containerised everything with Docker Compose
6. Deployed to Coolify at the target URL
7. Self-diagnosed a CSRF bug when Jake tested it — fixed it, added regression tests, redeployed

That last step is the one that matters. The agent didn't crash on an error. It caught a real bug, fixed it, and validated the fix. The loop was: prompt → repo → code → tests → CI → deploy → bug → fix → redeploy. All autonomous.

The Honest Limitations

Jake doesn't oversell it. He lists exactly what Hermes can still do to this setup:

• Nuke the new server and everything on it
• Delete repos, databases, and deployments
• Leak or abuse any credentials given to it
• Burn through inference tokens without bound
• Download arbitrary content from the internet
• Poke anything on the network the firewall allows

The containment isn't perfect. It's structural: the failure mode is "rebuild the eBay box and rotate a handful of keys," not "discover an LLM enthusiastically reorganised my actual laptop." That's a meaningful improvement, but it's not magic.

Why This Matters

The software industry is about to have a huge number of agents writing code autonomously. The conversation so far has been about capability — can the agent write the code? The next conversation is about containment — can the agent write the code without owning your life?

Jake's setup costs £20/month for inference, a used eBay server, and some configuration time. That's an existence proof that structural containment is achievable at hobbyist scale. The next step — VLAN isolation, narrowly-scoped credentials, one-shot rebuild automation — is just engineering.

The bottom line: don't trust your agent. Give it a machine it can trash.