Run CLI agents in isolated microVMs from your desktop. Keep your workflow — agents only access the folders and repos you specify.

Download v0.1.1 View on GitHub →

What It Is

Sandboxed AI agents

Each agent session runs inside a Docker Sandbox microVM with hypervisor-level isolation. Agents read and modify your project files, but cannot reach outside their declared network policy.

Unified management

Create personas for Claude Code, Codex, GitHub Copilot, Kiro, Cursor, Gemini, and custom agents. Configure workspaces, network policies, per-agent memory, and MCP server integrations from one UI.

Native CLI feel

Agents run in a real terminal environment — Claude Code, Codex, Copilot, and others behave exactly as they would on your local machine. The sandbox looks and feels like your workstation to the agent.

Credential security

API keys and OAuth tokens are stored in your OS keychain via sbx secret — never written to disk or the application database. Beachead never sees your credentials in plaintext.

Download

Latest release: v0.1.1
Note: Binaries for v0.1.1 are not code-signed. On macOS, right-click the .dmg and choose Open to bypass Gatekeeper. On Windows, click "More info → Run anyway" if Defender SmartScreen appears. Linux binaries have no signing requirement.

Linux

Beachead_0.1.0_amd64.AppImage 76.8 MB · SHA256: 9a6f8788202b3edb289cd1ef92bb9c39e89b59c6f438f325805cb674bf21fa1b
Beachead_0.1.0_amd64.deb 5.9 MB · SHA256: aa784001ee9980b633e2796f228808f98e8a0a64b2915caf213c33805d5ab1e6

macOS

Beachead_0.1.0_aarch64.dmg 7.1 MB · SHA256: e276f7787ab43797900f7b241643ae04bb7072dc2d046ebe95941622b8ae7b14

Windows

Beachead_0.1.0_x64-setup.exe 4.6 MB · SHA256: 68db2a9ae223611faaca43ff624a83325f52495971786a1664dbc892b56da354
Beachead_0.1.0_x64_en-US.msi 6.5 MB · SHA256: 8790afab5dcddc80e7eb12e31374784ebb0c7afd341854d1f5616c460476e09b
Verify your download

macOS / Linux

echo "<sha256>  <filename>" | sha256sum --check

Windows (PowerShell)

Get-FileHash <filename> | Format-List

Prefer to build yourself? Build from source →

Requirements

Dependency Purpose Install
Docker Engine Container runtime for sandboxes and memory containers docs.docker.com
Docker Sandboxes (sbx) CLI for managing sandbox microVMs github.com/docker/sbx-releases
Git optional Required for Repo Sync features git-scm.com