Architecture and isolation
comcon is self-contained by design — no Cloudflare, no Tailscale, no hosted coordination server. One VPS, one Caddy on :443, per-user Podman containers, published SSH ports. That is the whole data plane.
The two interaction models
Native web surfaces. Zellij, agent web UIs, and your dev servers already speak HTTP, so Caddy proxies them directly. There is no pixel machinery for these.
Remote attach. Coding agents run inside the container and you attach from your own client: Devin through a devin-server backend over SSH (the same architecture as VS Code Remote), Claude Code and Codex as terminal UIs. Authentication files live in your container home, so they persist across hibernates and your local client never re-authenticates.
One streamed surface
The browser is the only surface streamed as pixels, because a signed-in visible browser is the one thing that must be shared between you and the agent:
- Chromium runs headful on Xvfb — bot detection sees a real browser, not
--headless. - A CDP screencast bridge (~20–40 MB resident, near-zero CPU when unwatched) serves
browser.<user>in your browser as a canvas. - Agents drive the same Chromium over CDP — your cookies, your tabs, shared live.
- An optional headless scratch browser exists for throwaway fetches and never touches your authenticated profile.
There is no streamed desktop and no per-app window streaming. GUI work happens through the browser surface, native web tools, or SSH.
The boundary that matters
| Rule | Why |
|---|---|
| The container is the user | No unix accounts; blast radius per person is one container |
| Sudo inside containers only | Agents install freely; the host is never reachable as root from a surface |
| Container ports on loopback only | Caddy is the sole public ingress on :443 |
| No container socket mounts | A Podman/Docker socket in a container is host-root-equivalent |
No host bind-mounts outside /srv | The host filesystem stays invisible |
| Host root over SSH keys only | Never proxied, never a web shell |
What the agent can operate
| Surface | Mechanism |
|---|---|
| Web apps | Shared Chromium + CDP + Playwright |
| Mobile web | Chromium device emulation |
| Terminal work | Zellij sessions that survive disconnects |
| Android | Optional Waydroid node, adb over a private link |
| Windows binaries | Optional Wine module, SSH only |
| macOS | Excluded by design — licenses tie to Apple hardware |
Data safety, in three tiers
- Git remotes — primary, for code.
- State sync — whole-disk snapshots on DigitalOcean;
rcloneto object storage elsewhere, on a schedule. - Container recreate — resets the OS layer in seconds;
/srv/home/<user>is untouched by design.