Give agents a computer.
Not the computer.
Ghost is a Rust-native shell and runtime that gives every agent an isolated execution environment — capable, familiar, and completely sealed off from the host.
Five priorities. One runtime.
Ghost is not a container wrapper or a thin front-end over /bin/bash. It is a purpose-built execution environment with its own shell, virtualized filesystem, process model, and permissions — where every capability an agent gets is explicit, inspectable, and enforceable.
Isolation
Every session has an empty environment by default: no host files, processes, sockets, credentials, or neighbors.
Performance
Ordinary commands run in-process in Rust — no container startup, no shell fork, no OS process per tool call.
Security
Deny-by-default capabilities. Dangerous functionality is removed, not just discouraged in a prompt.
Scalability
Thousands to millions of isolated execution contexts across a distributed deployment, per-session accounted.
Agent-Native
Every action produces structured execution metadata: inputs, outputs, files, network, resources, and result.
A shell that feels like bash. Runs like a runtime.
Familiar pipes, redirects, jobs, and exit codes — but every operation is executed by the Ghost runtime, not blindly delegated to the host. Data moves between built-in tools in-process, without spawning OS processes or serializing across boundaries.
ghost://sess-a3f24c$ mount /workspace --readonly ok /workspace mounted readonly (2 paths, 148 files) ghost://sess-a3f24c$ jq '.users[] | .email' data.json | sort -u alice@example.com ben@example.com carla@example.com ghost://sess-a3f24c$ http get https://api.internal/status deny destination not in network allowlist (policy: net.default) ghost://sess-a3f24c$ snapshot --tag pre-migration ok snap_9e3f fs+runtime 38 ms ghost://sess-a3f24c$ █
Enforced by the runtime. Not by the prompt.
Ghost assumes agent-generated code and commands are untrusted. Capabilities are granted explicitly and checked at every boundary — potentially dangerous functionality can be removed from an environment, not merely discouraged.
No implicit host filesystem access
No implicit host process execution
No inherited user credentials
Explicit network allowlists
Per-session resource quotas
Execution deadlines
Bounded output and storage
Immutable or read-only mounts
Secret injection without filesystem exposure
Auditable capability grants
Runtime-level command interception
Everything else, by default
Snapshot. Fork. Suspend. Destroy.
A Ghost session can live for one tool call, one task, or one multi-day workflow. Filesystem and runtime state snapshot independently from compute — environments suspend when idle and resume without keeping a process alive.
One session per anything.
A single tool call, an entire agent task, a multi-day workflow, or a long-running autonomous worker. Same interface, same guarantees.
Reproducible. Forkable.
- Reproducible agent runs
- Fast cloning of environments
- Rollback after failed actions
- Debugging and forensic inspection
- Cached development environments
- Branching agent workspaces
Isolation at the session, not the machine.
Resource accounting, scheduling, and quotas are built into the execution model. Tens of thousands of agents run concurrently, distributed across workers, with one logical interface.
A computer they can't misuse.
Traditional shells assume a trusted human user. Containers still expose an operating-system surface. Ghost starts from a different assumption: the code is untrusted, the executor may be autonomous, and every capability must be intentional.
“Ghost gives agents a computer without giving them the computer.”