# Bastion Self-hosted virtual machines for background coding agents. Source: https://wheredoirunthis.com/products/bastion · JSON: https://wheredoirunthis.com/api/products/bastion · Read on 2026-07-23 ## At a glance - Type: Sandbox - Kind: Open source tool - Isolation: Virtual machine - Free tier: Not documented - Starting price: Not disclosed - GPU: No - Regions: Not disclosed - Coverage: 8 of 54 assessed capabilities supported · 7 not assessed - Agent readiness: read 7 of 10 signals, drive 3 of 10 signals ## Links - Homepage: https://bastion.computer/ - Docs: https://bastion.computer/introduction/ - Repository: https://github.com/bastion-computer/bastion ## Runtime - **GPU & accelerators**: No — "No GPU provisioning/passthrough advertised. Cloud Hypervisor runs on KVM; any GPU would be a property of the operator's own host, not a Bastion-provided facet. Not offered." (source: docs (no GPU mention)) (confidence: medium) - **BYOC (Bring your own cloud)**: na — "na for a self-host OSS tool — Bastion runs entirely on YOUR own Linux/KVM host or cluster by definition (covered by self-host-oss). BYOC as a managed-service 'deploy into your cloud account' concept does not apply." (source: self-host model) (confidence: high) - **Secrets management**: First-class, namespace-scoped secrets store — `bastion secrets create --key OPENAI_API_KEY --value ...`, referenced in templates as ${{ secret.X }} and injected into agent auth/config, env files (write_env_file), and setup actions inside the guest. — "`bastion secrets create --key OPENAI_API_KEY`; templates reference '${{ secret.OPENAI_API_KEY }}', '${{ secret.ANTHROPIC_API_KEY }}', '${{ secret.GITHUB_TOKEN }}', AWS keys; cluster namespaces 'isolate secrets, templates, and environments'." [source](https://bastion.computer/guides/cluster/%20+%20/reference/configuration/) (confidence: high) - **Storage options**: Per-env qcow2 root volume (sized in the template); metadata in embedded SQLite (single host) or Postgres (cluster); cluster shared base + prepared template overlay archives stored in an S3-compatible bucket. — "Host API 'stores metadata ... SQLite'; cluster requires a 'Postgres database' (cluster nodes/namespaces/routing) + an 'S3-compatible bucket' (shared base + template overlay archives)." [source](https://bastion.computer/guides/cluster/) (confidence: high) - **Supported workloads**: background-coding-agents, parallel-agent-tasks, per-issue-review-environments, reproducible-dev-environments, async-agent-runs — "'Orchestrate coding agents across a cluster of physical servers and run them asynchronously in the background'; the bastion-demo runs 'five independent coding tasks' as parallel per-issue environments (tags like repo:bastion, agent:review, issue-32)." [source](https://bastion.computer/) (confidence: high) - **Persistence**: Disposable Cloud Hypervisor VMs with a writable qcow2 ROOT overlay (default 20 GiB, sized per template) backed by an immutable template overlay backed by the shared base. Durable for the environment's lifetime (survives VM pause/stop) but there is no separate attachable/reattachable volume, and envs are torn down explicitly via `bastion env remove` (no auto-persistence beyond removal). — "'An environment is a Cloud Hypervisor VM with a writable qcow2 root disk overlay backed by an immutable template overlay, which is itself backed by the shared base.' Statuses: creating/running/paused/stopped/error/removed." [source](https://bastion.computer/guides/environments/) (confidence: high) - **Data jurisdiction**: na — "na — data residency / region is entirely the operator's choice (wherever your KVM host or cluster nodes run). No product-operated regions." (source: self-host model) (confidence: high) - **Resource limits & quotas**: Operator-bounded — limited by your host's (or cluster's) CPU/memory/disk. Per-env resources (vcpu default 2, memory default 2 GiB, volume default 20 GiB) are declared per template; on a cluster, `env create` schedules onto a node with enough capacity and FAILS rather than overcommitting. No product-imposed SaaS quotas. — "'Environment creation chooses a node with enough available vCPU, memory, and volume ... If no registered node has enough capacity, `bastion env create` fails instead of overcommitting the cluster.'" [source](https://bastion.computer/guides/cluster/%20+%20/guides/templates/) (confidence: high) - **SDK languages**: Not documented — "No client SDK library is published — the interfaces are the `bastion` CLI and a raw HTTP API (host :3148 / cluster :3150). Template/agent configuration is schema-validated JSON." (source: docs) (confidence: high) - **Network & egress controls**: VM-level network isolation (each env gets its own TAP interface + DHCP via dnsmasq; NAT egress via iptables + IPv4 forwarding), but NO configurable egress firewall / allowlist / outbound policy is exposed. — "Required host utilities include `iptables` ('Configure forwarding and NAT'), `sysctl` ('Enable IPv4 forwarding'), `dnsmasq` ('Provide DHCP for each VM's TAP network'). Isolation is per-VM; no policy-driven egress control documented." [source](https://bastion.computer/guides/system/) (confidence: high) - **Snapshots & forks**: Copy-on-write LAYERING (base → immutable prepared template overlay → per-env COW overlay) — disposable environments are effectively forked from a prepared template layer, enabling parallel isolated agents from one prepared image. Cloud Hypervisor `paused` state is exposed. No user-facing live-VM snapshot / restore / export of a running environment. — "'prepare a shared base once, install project dependencies in a template overlay, then create isolated copy-on-write environments from that layer'; template creation 'stores the resulting overlay as immutable. Every Bastion environment VM is then backed by a prepared template.'" [source](https://bastion.computer/guides/templates/) (confidence: high) - **Deployment methods**: cli, api — "Primary interface is the `bastion` CLI (`templates create`, `env create`, `ssh`, `proxy`, `opencode`, `mux`); everything is also reachable over the HTTP API (localhost:3148 host, localhost:3150 cluster, /v1/... resources returning NDJSON log/result/error events). Workloads are defined as schema-validated JSON templates." [source](https://bastion.computer/reference/api/) (confidence: high) - **Isolation**: Virtual machine — "'Each agent runs in a separate Cloud Hypervisor VM' — 'each environment has its own guest kernel, root filesystem, processes, and network.' The VMM is Cloud Hypervisor (a Rust microVM-class hypervisor, cloudhypervisor.org), booting an Ubuntu-24.04 guest kernel over KVM. No dedicated isolationEnum value exists for Cloud Hypervisor, so `vm` is the correct strong-isolation code (own-kernel VM, hypervisor named). This is genuine VM-level isolation — stronger than a container, distinct from Firecracker/kata-gvisor by name." (source: README 'How it works' + /guides/environments/ + /guides/system/) (confidence: high) ## Capabilities ### AI & agents | Capability | Status | Evidence | | --- | --- | --- | | Agent skills | Not supported | "No Bastion agent-skills/tools primitive (skills belong to the OpenCode agent, not Bastion). Bastion's 'actions' are host-side env-setup steps, not agent skills." [source](https://bastion.computer/) | | AI app builder | Not supported | "No prompt-to-app / vibe-coding generation surface." [source](https://bastion.computer/) | | Autonomous QA agent | Not supported | "No first-party autonomous QA/testing agent (you could run one via OpenCode, but it is not shipped)." [source](https://bastion.computer/) | | Built-in coding agent | Partially supported | "Bundles + manages a coding agent (OpenCode) as the core per-env agent server — the base installs a pinned OpenCode binary and `bastion opencode` attaches its TUI. But the agent is THIRD-PARTY OpenCode, not a first-party Bastion agent." [source](https://bastion.computer/reference/configuration/) | | BYOK for LLMs | Supported | "Bring-your-own provider keys via secrets injected into OpenCode auth: 'auth: { anthropic: { type: api, key: ${{ secret.ANTHROPIC_API_KEY }} } }' (also OpenAI, etc.); model set via config, e.g. 'model: anthropic/claude-opus-4-8'." [source](https://bastion.computer/reference/configuration/) | | Credential-injection proxy | Not assessed | | | LLM gateway | Not supported | "No multi-provider LLM gateway/router; provider keys are passed straight through to the OpenCode agent." [source](https://bastion.computer/) | | MCP client | Not supported | "Bastion itself is not an MCP client (the OpenCode agent it runs inside a VM may be, but that is not a Bastion facet)." [source](https://bastion.computer/) | | MCP-server hosting | Not supported | "Does not host MCP servers as a managed workload (you could run one manually inside a VM, but it is not a Bastion primitive)." [source](https://bastion.computer/) | | MCP server | Not supported | "Bastion exposes no Model Context Protocol control server (no /.well-known/mcp, no documented MCP endpoint or npm-installable MCP server)." [source](https://bastion.computer/) | | Model inference API (first-party) | Not supported | "Serves no first-party model inference API — it runs an agent that CALLS your own providers." [source](https://bastion.computer/) | | Preinstalled coding agent | Not assessed | | ### Networking & delivery | Capability | Status | Evidence | | --- | --- | --- | | Automatic HTTPS | Not supported | "No per-workload TLS/HTTPS; access is host-local (localhost API) or SSH. Exposing/securing the API with TLS is the operator's job (Tailscale Serve / a reverse proxy)." [source](https://bastion.computer/examples/remote-access-with-tailscale/) | | Custom domains | Not supported | "No custom-domain mapping; preview tunnels are host-local URLs (localhost:3148/v1/environments/.../tunnels/)." [source](https://bastion.computer/guides/environments/) | | Direct public IPv6 | Not supported | "VMs sit behind NAT (TAP interfaces + IPv4 forwarding via iptables); no per-instance stable public IPv6 for raw TCP/UDP." [source](https://bastion.computer/guides/system/) | | Edge KV store | Not applicable | "Not an edge-runtime KV store." [source](https://bastion.computer/) | | Egress controls | Not supported | "Per-VM network isolation (own TAP interface + NAT egress via iptables), but no configurable egress firewall/allowlist/outbound policy exposed." [source](https://bastion.computer/guides/system/) | | Email send / receive | Not supported | "No email send/receive capability." [source](https://bastion.computer/) | | Public preview URLs | Partially supported | "'Conflict-free previews: expose dev servers on the guest VM through named tunnels for host side previews' — a host-LOCAL preview URL for a guest dev server, not a public/shareable link." [source](https://bastion.computer/guides/environments/) | | Private networking | Not supported | "Each environment is network-isolated (its own TAP interface); no private service-to-service mesh/VPC/service-discovery between environments is advertised." [source](https://bastion.computer/guides/environments/) | | Built-in reverse proxy | Supported | "Built-in host-side proxy to guest services: named tunnels reach guest localhost ports over Cloud Hypervisor vsock ('Bastion reaches them through a guest proxy over Cloud Hypervisor vsock'), and `bastion proxy --env-key --name ` forwards host requests (incl. absolute paths) to the named guest service." [source](https://bastion.computer/guides/environments/) | ### Organisation & security | Capability | Status | Evidence | | --- | --- | --- | | Built-in auth | Not supported | "The host/cluster API is unauthenticated by design — security is the operator's network boundary (localhost / Tailscale / TLS / cluster 'Security Notes'). No built-in auth for the platform or for user workloads." [source](https://bastion.computer/examples/cluster-with-docker-compose/) | | BYOC | Not applicable | "Self-host OSS runs entirely on your own infra by definition (covered by self-host-oss); BYOC as a managed-service 'deploy into your cloud account' concept does not apply." [source](https://bastion.computer/) | | Deploy into customers' VPCs | Not assessed | | | Secrets management | Supported | "First-class namespace-scoped secrets: `bastion secrets create --key OPENAI_API_KEY --value ...`, referenced in templates as ${{ secret.X }} and injected into agent auth/config, env files, and setup actions." [source](https://bastion.computer/guides/cluster/) | | Self-host / OSS core | Supported | "MIT-licensed; self-host is the ONLY deployment — `curl -fsSL https://bastion.computer/install.sh \| bash` on your own Linux/KVM host, or a multi-node cluster." [source](https://github.com/bastion-computer/bastion) | | Sharing | Not supported | "No share-a-running-environment-by-link primitive; preview tunnels are host-local, not shareable public URLs." [source](https://bastion.computer/guides/environments/) | | SSO / SAML | Not supported | "No SSO/SAML (no auth layer at all)." [source](https://bastion.computer/) | | Teams | Partially supported | "Cluster namespaces 'isolate secrets, templates, and environments' per tenant/team/automation context, but there is no hosted team-account/membership concept (self-host, no auth layer)." [source](https://bastion.computer/guides/cluster/) | | Workload identity | Not assessed | | ### Developer access | Capability | Status | Evidence | | --- | --- | --- | | CLI | Supported | "The official `bastion` CLI is the primary interface (system/base/templates/env/secrets/ssh/proxy/opencode/mux/cluster commands); installed by install.sh." [source](https://bastion.computer/reference/cli/) | | E2B-compatible API | Not assessed | | | Filesystem API | Not supported | "No remote filesystem API over HTTP (list/read/write/watch); file access is via SSH / scp into the guest." [source](https://bastion.computer/guides/ssh/) | | Git deploy | Not supported | "No push-to-deploy / git integration; repos are `git clone`d inside the env via template init actions." [source](https://bastion.computer/) | | HTTP data API | Not applicable | "Data-plane HTTP query API primitive — not applicable." [source](https://bastion.computer/) | | OpenAPI spec | Not supported | "No OpenAPI/Swagger spec (/openapi.json etc. all 404). A JSON Schema for TEMPLATES is published (/schemas/template.json, draft 2020-12) but that describes config, not the API." [source](https://bastion.computer/schemas/template.json) | | Private container registry | Not supported | "No hosted private container/image registry (Bastion uses VM disk images, not OCI images from a registry)." [source](https://bastion.computer/) | | Public API | Supported | "Documented HTTP API — host API on localhost:3148, cluster API on localhost:3150, /v1/... resource endpoints (environments, tunnels, secrets, templates, utilization, health) returning NDJSON log/result/error events." [source](https://bastion.computer/reference/api/) | | SDK | Not supported | "No client SDK library published — integration is via the CLI or the raw HTTP API." [source](https://bastion.computer/reference/api/) | | SSH access | Supported | "'bastion ssh --id ' opens an interactive PTY shell in a running environment (or runs a command); guests are provisioned with root SSH access, multiplexed over the host API's `bastion-ssh` protocol." [source](https://bastion.computer/guides/ssh/) | ### Compute & storage | Capability | Status | Evidence | | --- | --- | --- | | Cloud-init / ignition config | Not supported | "Cloud-init seed media is used INTERNALLY to boot each guest ('writes fresh cloud-init media'), but there is NO user-facing cloud-init/ignition user-data interface — launch-time customization is Bastion's own JSON `actions` (init/start) model, not cloud-init user-data. (That declarative init is captured by sandbox-templates=pass.)" [source](https://bastion.computer/guides/environments/) | | Desktop / computer-use sandbox | Not applicable | "No virtual desktop / computer-use GUI sandbox — headless Linux VMs." [source](https://bastion.computer/) | | GPU compute | Not supported | "No GPU provisioning/passthrough advertised; Cloud Hypervisor on KVM, GPU would be the operator's own host, not a Bastion facet." [source](https://bastion.computer/) | | Live-state (memory) snapshots | Not assessed | | | Multi-region | Partially supported | "The optional multi-node cluster 'schedules environments onto registered nodes' across your Linux machines (any location) — operator-chosen placement, not a product-operated multi-region service." [source](https://bastion.computer/guides/cluster/) | | Object storage | Not supported | "Bastion CONSUMES an S3-compatible bucket for cluster template/base archives; it does not PROVIDE object storage (buckets/presigned URLs) to your workloads." [source](https://bastion.computer/guides/cluster/) | | Persistent disk | Partially supported | "Each env has a writable qcow2 ROOT overlay (default 20 GiB, sized per template) durable for the env's lifetime (survives VM pause/stop), but there is no separate attachable/reattachable persistent volume, and envs are disposable (removed via `bastion env remove`)." [source](https://bastion.computer/guides/environments/) | | Sandbox templates / custom images | Supported | "The CORE primitive: schema-validated JSON templates (/schemas/template.json) → a prepared, immutable qcow2 overlay you fork disposable environments from ('prepare its dependencies once as an immutable disk layer, and create disposable VMs'). Layered base→template→env, with a reusable built-in action library (setup_node/bun/uv/mise/openjdk, setup_docker, ...)." [source](https://bastion.computer/guides/templates/) | | Scale to zero | Not supported | "Envs are running until explicitly removed; `paused`/`stopped` statuses exist but there is no automatic idle-suspend / scale-to-zero (and no usage billing to scale)." [source](https://bastion.computer/guides/environments/) | | Selectable isolation runtime | Not assessed | | | Snapshots / forking | Partially supported | "'create isolated copy-on-write environments from that layer' — COW fork from an immutable prepared template overlay (base→template→env). Cloud Hypervisor `paused` state exposed. No user-facing live-VM snapshot/restore/export." [source](https://bastion.computer/guides/templates/) | ### Data | Capability | Status | Evidence | | --- | --- | --- | | Database branching | Not applicable | "Data-layer (copy-on-write DB branch) primitive — not applicable to a VM/agent sandbox." [source](https://bastion.computer/) | | Ephemeral instant DB (no-signup) | Not applicable | "No-signup claimable-DB primitive — not applicable." [source](https://bastion.computer/) | | First-party database | Not applicable | "Bastion USES SQLite (single host) / Postgres (cluster) for its OWN metadata; it does not provision a managed database service for your workloads." [source](https://bastion.computer/guides/cluster/) | | Vector search | Not applicable | "No vector store/search — not a data layer." [source](https://bastion.computer/) | ### Platform & operations | Capability | Status | Evidence | | --- | --- | --- | | Managed CI/CD runners | Not supported | "Not a managed GitHub Actions/GitLab CI runner platform (per-task agent envs are CI-adjacent but not drop-in CI runners)." [source](https://bastion.computer/) | | Built-in observability | Partially supported | "Platform-level only: streamed creation-log NDJSON events, `/v1/utilization` (capacity across nodes), `/v1/health`, and env statuses/lastError. No first-party workload metrics/logs/tracing/APM." [source](https://bastion.computer/guides/cluster/) | | Preview environments | Partially supported | "Full isolated VM environments per task/branch (the demo runs five parallel per-issue envs, tagged repo:bastion / agent:review / issue-32) — but YOU or your automation create + remove them (`env create`/`env remove`); no native git-PR trigger, auto-teardown-on-merge, or bundled DB-branch." [source](https://github.com/bastion-computer/bastion-demo) | | Scheduled tasks | Not supported | "No cron/scheduled-job primitive; envs are created interactively / via automation." [source](https://bastion.computer/) | | Project template marketplace | Not supported | "Templates are your own JSON; a couple of example templates + a demo repo exist, but there is no marketplace/gallery of starter templates to clone." [source](https://bastion.computer/template-examples/bastion-dev-environment/) | | Durable workflows | Not supported | "No durable-execution/workflow engine; agents run inside VMs, orchestration of tasks is up to you." [source](https://bastion.computer/) | ## Agent readiness ### Read: 7 of 10 signals present 7/10 signals (7 full) - Llms txt: pass — "GET /llms.txt (200) lists documentation sets linking /llms-small.txt + /llms-full.txt — a valid, substantive llms.txt." - Llms full txt: pass — "GET /llms-full.txt (200, ~133 KB) — the complete docs as one markdown corpus (quick-start, guides, reference, examples, actions)." - Robots AI policy: fail — "robots.txt (Cloudflare-managed default) sets Content-Signal ai-train=no AND explicitly Disallows major AI UAs: ClaudeBot, GPTBot, Google-Extended, CCBot, Applebot-Extended, Bytespider, Amazonbot, meta-externalagent all `Disallow: /`. Blocks major AI crawlers = none." - JSON LD: fail — "No