Where agents run
Each agent runs in one of two places, chosen when you make it: directly on your computer, or inside its own Docker container. The choice decides how strong the wall around the agent is.
On this computer
The agent runs as an ordinary program under your user account. It starts at once and can use the programs and tools you already have. Its settings, sign-ins and folders are separate from every other agent's.
That separation is done by configuration, not by a sandbox. A local agent runs as you, so a misbehaving agent could go looking and read files that belong to DAC or to another agent. Use this mode for agents you trust.
Local agents also share your computer's network. Two agents that each start a server on port 3000 will collide.
In a container
The agent runs inside its own Docker container, a closed-off space with its own files and its own network. It cannot reach your personal files, DAC's own files or your other agents. Its files are kept outside the container, so they survive the container being rebuilt.
An agent in a container has a Container section in its Settings, where you can limit how much memory and processor time it may use and see what it is using now.
Containers still share your computer's operating system kernel, so they are a much stronger wall than local mode, but not a perfect one. Use this mode for agents that run code you have not reviewed.
Side by side
| Risk | On this computer | In a container |
|---|---|---|
| One agent's connectors, skills or GitHub sign-in showing up in another | Prevented | Prevented |
| One agent's settings or memory leaking into another by accident | Prevented | Prevented |
| An agent reading DAC's saved keys, or another agent's secrets, on purpose | Not prevented | Prevented |
| An agent reading your personal files | Not prevented | Prevented, except folders you share with it |
| An agent using up all the memory or processor | Not prevented | Limited |
| One agent reaching another over the network | Not prevented | Prevented |
The dashboard itself
The dashboard only listens to your own computer, so other devices cannot open it. It also checks where each request comes from, so a web page open in your browser cannot control your agents. Keep the dashboard link private: anyone who has it can use the dashboard.
Your saved keys and sign-ins are stored encrypted, and are only decrypted at the moment one agent needs them.