Activity

1. github-actions

   added

   needs-triage

   on Sep 24, 2026
2. github-actions commented on Sep 24, 2026

   

   github-actionsBot

   on Sep 24, 2026 – with GitHub Actions

   More actions

   Thanks for the report! A maintainer will triage this shortly and apply the appropriate label. Once a type label is added, the issue will be re-validated automatically.
3. github-actions

   added

   incomplete

   on Sep 24, 2026
4. chaodu-obk commented on Sep 24, 2026

   

   chaodu-obkBot

   on Sep 24, 2026 – with chaodu-obk

   ContributorAuthor

   More actions

   Additional driver candidate: k3s (Raspberry Pi / Intel mini PC / mixed cluster)

   Follow-up from the Discord discussion: if the host is a Raspberry Pi or an Intel mini PC instead of a Mac mini, the same sandbox_* schema maps onto a k3s cluster — arguably the cleanest driver of all, since the semantics correspond 1:1 to Kubernetes primitives:

   Tool	k3s implementation
   sandbox_create	Create a Pod (sleep infinity); ttl_secs → activeDeadlineSeconds
   sandbox_exec	pods/exec subresource (the streaming WebSocket/SPDY API behind kubectl exec)
   sandbox_exec_start / poll	nohup + tee to files inside the pod; poll reads byte offsets via exec (same job contract as instance-mcp)
   sandbox_list	List pods by label selector
   sandbox_terminate	Delete pod

   Per-sandbox resource quotas (CPU/RAM limits), multi-node scheduling, and node-failure rescheduling come for free from Kubernetes.

   Notes

   • Rewrite scope is small. The Mac-specific half of instance-mcp (ScreenCaptureKit / CGEvent / TCC) does not apply on Linux. The k3s gateway is just "MCP server + kube client" — a few hundred lines in Go (client-go) or Python (kubernetes client). The MCP tool schema and acceptance tests from this issue carry over unchanged.
   • The gateway does not need to run on the cluster node. The kube API is already remote; the gateway only needs a kubeconfig and can run anywhere on the tailnet (including next to the Fargate-hosted agent). This is more decoupled than the OrbStack driver, which must run on the Mac itself.
   • Single node: k3s server costs ~0.5–1 GB RAM on a Pi. For a permanently-single-node setup a plain docker driver is lighter, but k3s pays off the moment a second node is added (k3s agent join; sandboxes schedule across nodes with zero gateway changes).
   • Multi-arch: Pi = arm64, Intel mini PC = amd64. Toolchain images must be built multi-arch (docker buildx) or pods will fail to start on mismatched nodes.
   • Isolation is shared-kernel containers, same tier as the OrbStack driver. If a stronger boundary is needed later, k3s can swap the runtime to kata-containers without changing the driver interface.

   Updated driver matrix

   sandbox_* schema (stable)
    ├─ orbstack driver  → Mac mini (existing hardware, Phase 1)
    ├─ k3s driver       → Pi / mini PC / mixed cluster (self-hosted scale-out)
    └─ microvm driver   → AWS Lambda MicroVMs (strong isolation + per-second billing)
   
5. chaodu-obk

   closed this as completedon Sep 24, 2026