Overview
tentaflake is a generic NixOS flake template for running isolated AI agents on one machine. It provides reusable modules, agent builders, an installer, and operational checks for Hermes and ZeroClaw.
The system is designed around three properties:
- Isolation: each agent runs in a hardened container with explicit resources, workspace ownership, and networking.
- Controlled access: brokered egress and disposable workers narrow the paths from an agent to external services and host tools.
- Recovery: declarative configuration, quotas, backups, and testable NixOS generations make failure modes observable and reversible.
The dev security profile preserves compatibility and is not a security boundary for untrusted, continuously running agents. Review security profiles and the threat model before production use.