Fail-closed controllers
Non-root gVisor containers, read-only roots, empty capabilities, bounded resources, private state, and no direct network.
[ v0.4.0 · pre-1.0 ]
Isolated AI agents, declared with NixOS.
An open-source NixOS flake for running Hermes and ZeroClaw with fail-closed containers, brokered egress, disposable workers, and reproducible operations.
One NixOS brain · Many AI tentacles.
- runtime
- gVisor
- network
- broker only
- root
- read-only
NixOSHermes + ZeroClawbalanced by defaultMIT
[ 01 · boundaries first ]
Useful agents without ambient authority.
Every capability is declared at the layer that can actually enforce it. Unknown runtime evidence stays unknown instead of becoming a green status.
Narrow external access
Per-agent LLM and fetch brokers enforce exact models, hosts, budgets, credential substitution, and SSRF controls.
Bounded state and work
Fixed-size workspaces, disposable no-network workers, explicit approvals, encrypted backups, and auditable recovery paths.
[ 02 · architecture ]
One host. Separate control paths.
The controller never receives the host runtime socket or real provider credential. Network, tool execution, and persistent storage each have a distinct enforcement layer.
Explore the architecture- 01NixOS hostdeclarative policy · systemd · OCI runtime
- 02Agent controllerHermes or ZeroClaw · no ambient network
- 03aBrokerLLM and allowlisted HTTPS03bWorkerdisposable offline execution03cWorkspacefixed-size persistent state
[ 03 · security evidence ]
Claims stay attached to evidence.
Machine-readable posture
tentaflake doctor --security separates configured policy, live evidence, warnings, and unknowns.
Negative integration tests
An external attacker node exercises denied ports, metadata access, direct DNS, private ranges, resource ceilings, and reboot recovery.
Documented non-goals
The threat model does not claim prompt-injection resistance, daemon-level UID remapping, a separate kernel, or deployment proof from evaluation alone.
[ 04 · start safely ]
Choose the path that matches your host.
Install a dedicated host
Build the installer ISO, test it in a disposable UEFI VM, then install to an explicitly selected disk.
Open the install guideAdd tentaflake as an input
Import the module, declare a stopped capsule, evaluate and build first, then activate in a controlled window.
Read the secure quickstart[ 05 · supported runtimes ]
Two controllers. One security contract.
Hermes
A capable general agent controller with a dedicated non-root identity and private workspace.
ZeroClaw
A compact autonomous runtime held to the same final container policy and broker boundary.
[ 06 · direct answers ]
Questions, answered precisely.
What is tentaflake?
tentaflake is an open-source NixOS flake template for operating isolated AI agent controllers on hardware you manage. It provides the host, container, policy, worker, storage, and verification layers; it does not implement an agent model or hosted control plane.
Which agent runtimes are supported?
Version 0.4 supports Hermes and ZeroClaw. Each runtime is declared through a dedicated Nix builder and receives the same post-merge container security policy. The upstream agents remain separate projects and are consumed as digest-pinned images.
What does balanced security mean?
Balanced agents run non-root through gVisor with a read-only root filesystem, no capabilities, bounded resources, no published ports, and no direct network. Automatically started controllers also require an exact broker, disposable worker, and fixed-size workspace declaration.
Does tentaflake include an LLM provider?
No. You supply an approved provider or local endpoint. Real provider credentials stay on the host and enter the broker through runtime-only systemd credentials. An agent receives a short-lived virtual credential scoped to its declared policy.
Is version 0.4 production-ready?
tentaflake is explicitly pre-1.0. The repository documents enforced controls, evidence gaps, residual risks, and a deployment acceptance checklist. Pin a release, read the threat model, and validate the exact target host before relying on it.
[ declare · verify · activate ]