Nyia Keeper¶
Run powerful AI coding CLIs in a box. Claude, Gemini, Codex, OpenCode, and Vibe each run in a Docker container that sees your project — and nothing else on your machine.
Get started in 2 minutes → Why it exists →
Why Nyia Keeper¶
- Runs in a box, not on your machine — each assistant runs in its own Docker container against
your project. It can't reach the rest of your machine — not your home directory,
~/.ssh, or your root filesystem. This is what "safe by default" means: a bounded blast radius — not VM-grade escape isolation. - You curate what it sees — mount exclusions keep secrets (
.env, keys,.aws/, …) out of the container. The auto-detected list is a starting point: review it and add your own private files before your first launch. Git history cutoff keeps old commits out of reach too. - Forces git discipline — work runs inside a Git repo on a work branch, never directly on protected branches (branch management), so a mistake — yours or the agent's — is recoverable and reviewable.
- Optionally restrict the network — by default the container has ordinary network access (the assistants need the internet). Opt in to network egress control to keep full web access while blocking the local network unless you allow it (off by default, Linux-only).
- Built for real work — workspace mode across multiple repos, reusable work branches, and flavors & overlays for custom toolchains.
- Team resources — share skills, personas (agents), and prompt overlays across your projects with a team directory: a local folder you sync however you like (git, Dropbox, NFS).
Find your way¶
| I want to… | Go to |
|---|---|
| Install and run my first assistant | Quick Start · Installation |
| Keep secrets / old history away from the AI | Mount Exclusions · Git History Cutoff |
| Understand the security model & its limits | Security model |
| Compare it to Docker Sandboxes / devcontainers | How it compares |
| Restrict what the container can reach on the network | Network Egress |
| Work across multiple repositories | Workspace Mode |
| Share skills / personas / prompts with my team | Team Sharing |
| Tell my team what changed | Team news — /nyia-whatsup |
| Track plans & todos across sessions | Plan tracking |
| Look up a flag or config key | CLI Reference · Configuration |
| Fix a problem | Troubleshooting |
Open source, not open contribution¶
Nyia Keeper is the public distribution of a tool I build for myself and use daily. It's open
source — AGPL-3.0-or-later OR Proprietary. Development happens in a private repo, so this one takes
no code contributions, but Issues and
Discussions are open — bug reports,
questions, and ideas are very welcome.