The One-Click Trap: Your AI Agent Needs a Persistent Linux Box, Not a Sandbox

TL;DR

• For an agent that runs multi-step or multi-hour jobs, an always-on box beats a throwaway sandbox: it keeps running after you close the laptop and keeps its state between sessions.
• Agent Shell boxes run 24/7 on every tier, including free, with 0 idle timeout and 0 trial countdown, and /root is the only path that survives a rebuild.
• Root on an Agent Shell box is fake-root via userns-remap plus a gVisor sandbox, so an agent gets real Linux power without a raw VPS underneath.

Use a permanent, always-on box. A temporary sandbox dies when your terminal closes, and an agent that only runs while your laptop is open is not an agent, it is a script. We build and operate xShellz, the borg terminal agent and the Agent Shell boxes behind this, and this is the setup we run in production ourselves.

Should I use a temporary sandbox or a permanent always-on box for my AI coding agent?

Use a permanent, always-on box for anything that takes more than a single prompt. An ephemeral sandbox is the right tool for a one-off, isolated job: compile an untrusted repo, test a sketchy dependency, throw it away after. An agent coding task is different: a refactor across 40 files, a scraping job that runs for hours, a debug session you pick up tomorrow. Those need a box that stays up, keeps its files and lets you reconnect. If the environment vanishes when the job is only half done, the agent has to start over, and LLM agents are not good at resuming from a dead filesystem. The Agent Shell is built for the second case: Ubuntu 24.04 LTS, running 24/7, with /root as a persistent home that survives rebuilds.

what is the difference between an ephemeral sandbox and an always-on box?

The difference is state. An ephemeral sandbox is created for one task and the whole filesystem goes away when it stops. An always-on box keeps running and keeps its state. On an Agent Shell box, /root is the persistent home and the only path that survives a rebuild on a newer image; everything outside /root is ephemeral and resets. Stopped boxes are kept for 30 days before cleanup, so nothing is lost if you pause for a while. Every tier is always-on, including free, with 0 idle timeout. That is the distinction that matters for agents: a sandbox that resets its filesystem between runs is a clean room, while an always-on box is a workshop where the half-finished work stays where you left it.

can my AI agent keep working if I close my laptop or lose internet?

Yes, on an always-on box. The box keeps running when your laptop is closed, with no idle timeout and no trial countdown. That is the whole point: an agent that only runs while your terminal is open is a script, not an agent. Start the job inside tmux and it is still running tomorrow:

tmux new -s agent borg "fix the failing test"

This starts borg, the one-binary terminal coding agent, inside a tmux session named agent. Close the laptop, lose the internet, come back and reattach to that tmux session to see the result.

how do I give an AI agent a permanent home with real root access?

You log in as root over SSH and /root is your persistent home. /home points into /root, so a service account like znc keeps its config across rebuilds too.

ssh -p <port> root@<host>

Replace <port> and <host> with the values from your box. You get a shell as root on an Ubuntu 24.04 LTS box, and files you write under /root survive an image rebuild. To reproduce your full setup on any box, write an xshellz.box manifest in your home directory, one line per package:

git
apt:build-essential
pip:requests

The manifest is reinstalled on every boot, so every box you build ends up with the same environment. Node 22, Python 3, git, ripgrep, tmux, build-essential, nano, vim and htop come preinstalled, so the manifest only needs the extras.

is it safe to give an AI agent root access to an always-on box?

Yes, if the root is fake-root and not a raw VPS. An agent with root on a bare VPS can trash the machine or get the box flagged. An Agent Shell box runs root through userns-remap plus a gVisor sandbox: the root user inside the box maps to an unprivileged user ID on the host, and gVisor sits between the agent and the kernel. The agent gets a real Linux environment with root-level file access inside the box, without touching the host. The internals are documented upstream: gVisor and Linux user namespaces. That is the tradeoff we accepted for production: real root for the agent, no raw VPS under it.

Frequently asked questions

Does the free tier keep the box running when I'm not connected?

Yes. Every tier, including free, is always-on and runs 24/7 with 0 idle timeout and 0 trial countdown. An agent started before you log off keeps running and is still there when you come back, because the box never sleeps.

What survives if my box is rebuilt on a newer image?

Only /root persists, and /home points into /root so service accounts keep their config too. Everything outside /root is ephemeral and resets on a rebuild. Your xshellz.box manifest is reinstalled on every boot, so the environment is always reproducible.

Which coding agents can I run on an Agent Shell box?

Six come preinstalled and ready to run: borg, Claude Code, Codex, Gemini CLI, opencode and pi. All of them are bring-your-own-key, so you plug in your model credentials and start coding, with nothing to install.