智能工作流 是 AI Skill Hub 本期精选Agent工作流之一。综合评分 7.5 分，整体质量较高。我们推荐使用将其纳入你的 AI 工具库，帮助提升工作效率。
隔离AI代理，提供Docker和systemd支持
智能工作流 是一套完整的 AI Agent 自动化工作流方案。通过可视化的节点编排，将复杂的多步骤任务拆解为清晰的自动化流程，实现全程无人值守的智能处理。支持与数百种外部服务和 API 无缝集成，适合构建数据处理管线、业务自动化和 AI 辅助决策系统。
隔离AI代理，提供Docker和systemd支持
智能工作流 是一套完整的 AI Agent 自动化工作流方案。通过可视化的节点编排，将复杂的多步骤任务拆解为清晰的自动化流程，实现全程无人值守的智能处理。支持与数百种外部服务和 API 无缝集成，适合构建数据处理管线、业务自动化和 AI 辅助决策系统。
# 方式一：pip 安装（推荐）
pip install code-on-incus
# 方式二：虚拟环境安装（推荐生产环境）
python -m venv .venv
source .venv/bin/activate # Windows: .venv\Scripts\activate
pip install code-on-incus
# 方式三：从源码安装（获取最新功能）
git clone https://github.com/mensfeld/code-on-incus
cd code-on-incus
pip install -e .
# 验证安装
python -c "import code_on_incus; print('安装成功')"
# 命令行使用
code-on-incus --help
# 基本用法
code-on-incus input_file -o output_file
# Python 代码中调用
import code_on_incus
# 示例
result = code_on_incus.process("input")
print(result)
# code-on-incus 配置文件示例（config.yml） app: name: "code-on-incus" debug: false log_level: "INFO" # 运行时指定配置文件 code-on-incus --config config.yml # 或通过环境变量配置 export CODE_ON_INCUS_API_KEY="your-key" export CODE_ON_INCUS_OUTPUT_DIR="./output"
<p align="center"> <img src="misc/logo.png" alt="Code on Incus Logo" width="350"> </p>
Core Capabilities - Multi-slot support - Run parallel AI coding sessions for the same workspace with full isolation - Session resume - Resume conversations with full history and credentials restored (workspace-scoped) - Persistent containers - Keep containers alive between sessions (installed tools preserved) - Workspace isolation - Each session mounts your project directory - Slot isolation - Each parallel slot has its own home directory (files don't leak between slots) - Workspace files persist even in ephemeral mode - Only the container is deleted, your work is always saved - Container snapshots - Create checkpoints, rollback changes, and branch experiments with full state preservation
Host Integration - SSH agent forwarding - Use git-over-SSH inside containers without copying private keys ([ssh] forward_agent = true) - Environment variable forwarding - Selectively forward host env vars by name (forward_env in config) - Host timezone inheritance - Containers automatically inherit the host's timezone (configurable via [timezone] config) - Sandbox context file - Auto-injected ~/SANDBOX_CONTEXT.md tells AI tools about their environment (network mode, workspace path, persistence, etc.). Automatically loaded into each tool's native context system: Claude Code via ~/.claude/CLAUDE.md, OpenCode via the instructions field in opencode.json (opt out with auto_context = false)
Security & Isolation - Credential protection - SSH keys, .env files, Git credentials, and environment variables are never exposed unless explicitly mounted - Privileged container guard - Refuses to start when security.privileged=true is detected, which defeats all container isolation - Security posture verification - coi health checks seccomp, AppArmor, and privilege settings to confirm full isolation - Kernel version enforcement - Warns on host kernels below 5.15 that may lack security features for safe isolation - Real-time threat detection - Kernel-level nftables monitoring detects reverse shells, C2 connections, data exfiltration, DNS tunneling, and credential scanning - Automated response - Auto-pause on HIGH threats, auto-kill on CRITICAL — no manual intervention needed - Network isolation - Firewalld-based restricted/allowlist/open modes block private network access and prevent exfiltration - Protected paths - .git/hooks, .git/config, .husky, .vscode mounted read-only to prevent supply-chain attacks - Host-side immutable protection - Protected paths are locked with chattr +i during sessions, preventing unshare -m + umount bypass of read-only mounts (opt out: [security] host_immutable = false) - Git identity guard - Containers enforce user.useConfigOnly=true, preventing AI tools from committing as the default "code" user - Guest API disabled - Incus guest API (/dev/incus) disabled by default, preventing host path and topology leaks - System containers - Full OS isolation with unprivileged containers, better than Docker privileged mode - Automatic UID mapping - No permission hell, files owned correctly - Audit logging - All security events logged to JSONL for forensics and compliance
Safe Dangerous Operations - AI coding tools often need broad filesystem access or bypass permission checks - These operations are safe inside containers because the "root" is the container root, not your host system - Containers are ephemeral - any changes are contained and don't affect your host - This gives AI tools full capabilities while keeping your system protected
curl -fsSL https://raw.githubusercontent.com/mensfeld/code-on-incus/master/install.sh | bash
coi build
Incus is a modern Linux container and virtual machine manager, forked from LXD. Unlike Docker (which uses application containers), Incus provides system containers that behave like lightweight VMs with full init systems.
sudo in the workspace will be root-owned — the sandbox context file instructs AI tools to fix ownership after sudo operations.)```bash
curl -fsSL https://raw.githubusercontent.com/mensfeld/code-on-incus/master/install.sh | bash
```bash
coi build
coi build --compression none
coi profile create my-image --image my-image
coi build --profile my-image ```
What's included in the coi-default image: - Ubuntu 22.04 base with Docker (full Docker-in-container support) - mise (polyglot runtime manager) — Python 3, pnpm, TypeScript, tsx pre-installed; add more with mise use go@latest, mise use ruby@3, etc. - Node.js 20 LTS (system, for Claude CLI) + npm - Claude Code CLI (default AI tool) + GitHub CLI (gh) - tmux, git, curl, build-essential, and common build tools - Modern CLI utilities: fd-find, bat, tree - Debugging tools: strace, lsof - Database clients: sqlite3, postgresql-client, redis-tools - imagemagick for image processing
Custom images: Build your own specialized images using profile-based build scripts that run on top of the base coi-default image. See the Image Management wiki page for complete profile-based build workflows.
```bash
See the wiki for detailed documentation:
[tool] name = "claude" # Default AI tool permission_mode = "bypass" # "bypass" (default) or "interactive" ```
See the Supported Tools wiki page for detailed configuration, API key setup, and adding new tools.
```
[container] alias = "myproject"
See the Container Lifecycle and Sessions guide for full alias documentation.
[container] persistent = true ```
What persists: - Ephemeral mode: Workspace files + session data (container deleted) - Persistent mode: Workspace files + session data + container state + installed packages, system setup
See the Container Lifecycle and Sessions guide for details.
Config file: ~/.coi/config.toml
```toml [container] image = "coi-default" persistent = true
[limits.cpu] count = "2"
[limits.memory] limit = "2GiB"
[limits.runtime] max_duration = "2h" ```
What you can limit: - CPU cores and usage percentage - Memory and swap - Disk I/O rates - Maximum runtime and process count - Auto-stop on time limits
[network] mode = "restricted" # Default — blocks private networks, allows internet
[monitoring] enabled = true ```
Protects against: - Reverse shells - Detects common reverse shell patterns (auto-kill) - Data exfiltration - Monitors large workspace reads/writes (auto-pause) - Environment scanning - Flags processes searching for API keys and secrets - Network threats (NFT) - Kernel-level detection of C2 connections, private network access, DNS tunneling, and allowlist violations
Automated response levels: - INFO/WARNING: Logged (+ alert for WARNING) - HIGH: Container paused (requires coi unfreeze to continue) - CRITICAL: Container killed immediately
Audit logs are stored at ~/.coi/audit/<container-name>.jsonl in JSON Lines format.
See the Security Monitoring wiki page for monitoring commands, configuration options, NFT setup, and audit log management.
| Capability | **code-on-incus** | Docker Sandbox | Bare Metal |
|---|---|---|---|
| **Credential isolation** | Default (never exposed) | Partial | None |
| **Real-time threat detection** | Kernel-level (nftables) | No | No |
| **Reverse shell detection** | Auto-kill | No | No |
| **Data exfiltration alerts** | Auto-pause | No | No |
| **Network isolation** | Firewalld (3 modes) | Basic | No |
| **Protected paths** | Read-only mounts | No | No |
| **Auto response (pause/kill)** | Yes | No | No |
| **Audit logging** | JSONL forensics | No | No |
| **Supply-chain attack prevention** | Git hooks/IDE configs protected | No | No |
See the Troubleshooting guide for common issues and solutions.
Common issues: - DNS issues during build - COI automatically fixes systemd-resolved conflicts - Run coi health to diagnose setup problems - Check the troubleshooting guide for detailed solutions
See the FAQ for answers to common questions.
Topics covered: - Orphaned firewalld zone bindings (Docker + firewalld interaction) - How COI compares to Docker Sandboxes and DevContainers - Windows support (WSL2) - Security model and prompt injection protection - API key security and trust model - What is Incus? (vs tmux)
AI Skill Hub 为第三方内容聚合平台，本页面信息基于公开数据整理，不对工具功能和质量作任何法律背书。
建议在沙箱或测试环境中充分验证后，再部署至生产环境，并做好必要的安全评估。
✅ MIT 协议 — 最宽松的开源协议之一，可自由商用、修改、分发，仅需保留版权声明。
经综合评估，智能工作流 在Agent工作流赛道中表现稳健，质量良好。如果你已有明确的使用需求，可以直接上手体验；如果还在评估阶段，建议对比同类工具后再做决策。
| 原始名称 | code-on-incus |
| 原始描述 | 开源AI工作流：Give each AI agent its own isolated machine with root, Docker, and systemd. Acti。⭐523 · Python |
| Topics | ai-toolsagentic-aipython |
| GitHub | https://github.com/mensfeld/code-on-incus |
| License | MIT |
| 语言 | Python |
收录时间：2026-05-26 · 更新时间：2026-05-26 · License：MIT · AI Skill Hub 不对第三方内容的准确性作法律背书。
选择 Agent 类型，复制安装指令后粘贴到对应客户端