Crabbox

Why it's ranked here

The appeal is breadth without forcing every workflow into provider-specific scripts. One command surface covers short runs, reusable machines, interactive access, checkpoints, artifacts, desktop testing, and parallel shards. The architecture also separates generic lifecycle policy from infrastructure adapters. The catch is operational weight: shared use requires deploying and securing a coordinator, while execution behavior and isolation still vary by provider.

What's good

The normal data path sends SSH traffic and repository synchronization directly between the client and runner, while cloud credentials remain with the coordinator. Matching fingerprints can skip synchronization entirely, and first sync can seed Git so only changes travel. Remote exit codes pass through to callers. Run history, logs, events, results, cost estimates, spend caps, expiry, and cleanup make automated work easier to audit and govern.

Tradeoffs

Crabbox is not a hostile multi-tenant sandbox, secrets scrubber, CI replacement, or uniform isolation layer. It trusts the local user, repository automation, project tooling, and coordinator operators. Captured output and failure bundles may expose secrets unless checked before sharing. Delegated providers restrict features such as SSH, desktop access, checksum sync, and Actions hydration. Direct mode also loses central history and spend caps.

How to use it well

Use Crabbox for maintainers, contributors, and agents that need repeatable tests, builds, browser checks, GPU work, or platform validation away from a laptop. Start with one-shot runs, then retain a warm runner when setup dominates execution. Add the coordinator when a trusted team needs shared credentials, budgets, history, and cleanup. Keep CI for merge gates, and choose a purpose-built security boundary for mutually untrusted workloads.

Observed

License

MIT

Primary implementation

Go CLI with a TypeScript coordinator described for Cloudflare and Node.js runtimes

Installation

Homebrew tap or GoReleaser archives

Interfaces

Command-line client, coordinator API, authenticated web portal, SSH, and delegated provider adapters

Client platforms

macOS, Linux, and Windows

Coordinator deployment

Cloudflare Workers with a Durable Object, Node.js with PostgreSQL and pg-boss, or no coordinator

Compute support

Managed clouds, local runtimes, existing SSH hosts, self-hosted infrastructure, and delegated sandbox providers

Local prerequisites

Git, SSH, ssh-keygen, rsync, and curl