# Self-host open-source cloud agents whose rules live in your repo > A self-hosted cloud agent is yours when the agent's definitions and its grants live in files on a branch you can diff and roll back. Kortix is the open-source AI Operating System. Its control plane runs on your server. The sessions it starts run on Platinum sandboxes. URL: https://cloudagentsguide.com/self-hosted-cloud-agents ## Self-hosted cloud agents, on where the control plane and the grants live What each vendor documents about its own architecture, checked in October 2026. | | Kortix (recommended) | Coder Agents | Cursor self-hosted machines | OpenHands | | --- | --- | --- | --- | --- | | where the control plane runs | On your server, one Docker Compose stack. | In your Coder deployment, on your infrastructure. | In Cursor's cloud. | In your environment, on-prem or private cloud. | | where a session runs | On Platinum sandboxes, off your box. | In a Coder workspace you provision. | On a machine in your network, through a worker. | Locally, in the cloud or in your VPC. | | where agent definitions live | In your repo: agents/.md and its kortix.yaml grants. | In the control plane; the agent is built in. | In Cursor's cloud; your machines run tool calls. | In your repo: AGENTS.md and .agents/skills/. | | open source | Yes | Yes, the platform is open source | No | Yes, an open-source core | | self-host | Yes, and it is free to run | Yes, there is no hosted component | Execution only; the agent loop stays with Cursor | Yes, on-prem or private cloud | ## The two files that define an agent Behaviour in the markdown, reach in the manifest, both on a branch a person reviews. ### kortix.yaml `kortix.yaml` ```yaml agents: kortix: file: agents/kortix.md connectors: all secrets: all kortix_permissions: all skills: all ``` Source: https://github.com/kortix-ai/suna/blob/dev/packages/starter/templates/base/kortix.yaml ### agents/kortix.md `agents/kortix.md` ``` --- description: "Generic Kortix general knowledge worker. Hands-on: handles coding / research / content / ops / data tasks end-to-end in an isolated session sandbox. Its access is what kortix.yaml grants it. Edit this file to specialize for your project." mode: primary permission: allow --- ``` Source: https://github.com/kortix-ai/suna/blob/dev/packages/starter/templates/base/agents/kortix.md ## Self-hosted covers four layers, not one Every vendor in this corner of the market calls something self-hosted. The word covers a control plane that holds accounts, projects and policies; the compute a session executes on; the files that define each agent; and the credentials an agent reaches for. A product can put the first on your hardware and leave the other three exactly where they were. ## Four questions to ask before you call it self-hosted ### The control plane: whose accounts, whose log Whoever runs the control plane decides what an agent can reach, and holds the log of what it reached. Coder Agents puts its agent loop inside the Coder deployment on your infrastructure. Cursor keeps the agent loop, inference and planning in its own cloud. OpenHands runs in your environment, on-prem or in a private cloud. Kortix is a Compose project you start on your own Linux box, and it holds the web app, `kortix-api`, `llm-gateway`, the Supabase distribution and Caddy. ### The session's compute: the part self-hosting does not move Moving the control plane does not move the work. Each Cursor self-hosted worker sits in your own network while planning and inference stay in Cursor's cloud; Coder hands the task to one of its workspaces; OpenHands can sit in your VPC, in its cloud or on a laptop. Kortix puts each session on Platinum, off the box that answers for the control plane. One isolated sandbox per session. Each session has its own isolated machine and branch. ### The agent file: behaviour in markdown, reach in the manifest For Kortix, in the repository. The behaviour of an agent lives in a markdown file, `agents/.md`; the reach it may use is a block under `agents:` in `kortix.yaml`. A new connector grant therefore reaches the branch as a diff, and a reviewer reads the reach an agent wants before the agent has it. Coder built its agent into the control plane, where administrators connect the model provider and choose which templates an agent may pick. Cursor's harness runs in Cursor's cloud, and the machine in your network executes the tool calls it receives. OpenHands reads `AGENTS.md` and `.agents/skills/` from the repository, so there too the instructions can be files you keep. The difference is in the grants. On Kortix the reach a scoped agent may use sits in the same reviewed file as its name: the connectors, the secret names, the permissions, the skills, beside the sandbox image and the triggers. ### The connector token: what never enters the sandbox A connector token is the credential with reach into your mail, your issue tracker or your CRM, and a sandbox runs commands that could read anything inside it. Connector credentials are brokered server-side and never enter the machine. The question to put to each vendor is where their token lives. ## The three ways Kortix runs, and the one that starts no sessions - **Domain mode.** `kortix self-host init --domain kortix.example.com` gives the app and the API public hostnames behind Caddy, with a certificate from ACME. Sessions start. - **Tunnel mode.** The same command with `--tunnel cloudflare` leaves the app on localhost:13737 and exposes only the API, through a Cloudflare tunnel. Sessions start. - **Local mode.** Neither flag: every port binds to 127.0.0.1, nothing is public, and no session starts, because a sandbox has nowhere to call back to. Domain mode is what production runs. The other two exist so you can try the stack on a laptop before you point a domain at it. ## The first hour, in order Five things stand between an empty server and a session that starts. Point the domain and the `api` host at the box with A and AAAA records, and add a wildcard for previews. Caddy claims the certificate over port 80, so those records have to resolve first. Leave 80 and 443 open. Run the bootstrap, which installs Docker and the CLI and brings the stack up. Give `kortix self-host configure` your admin address and a Platinum key, then run `kortix self-host start`. Sign up, connect GitHub at `/admin/git`, create a project and add a model key in the app. Two defaults matter before anyone else learns the hostname. Account creation is restricted by default, so only a platform admin can add an account, and until you set `EMAIL_URL` or `DISABLE_SIGNUP=true` the sign-up form confirms any address that reaches it. Neither default is a checkbox you tick once and forget; both are environment values the CLI writes into the instance directory, where you can read them. ## What the reviewed file looks like The manifest is the boundary: under `agents:`, one block grants an agent its connectors, secrets, permissions and skills and names the markdown file that decides how it behaves. Governance and behaviour sit in two files, and neither one is a screen. An agent the file does not grant starts with nothing: no connectors, no secrets, no permissions. The starter's own `kortix` agent is the exception, granted `all` on all four, so a fresh project is capable on day one. The template's own comment says to narrow that grant once the project's needs are known, and narrowing it is a diff on a branch. A checkbox in a dashboard records intent in a table you do not own and cannot diff. A deleted line in a manifest carries an author, a comment thread and a revert. ## The limits, stated plainly The stack is not an offline install. `kortix self-host start` pulls its images from Docker Hub. A Platinum API key has to exist before any session starts. The instance has to answer from the public internet so a sandbox can call back. Fully isolated topologies are scoped with Kortix rather than self-served. A self-hosted instance also has no managed model lineup: you connect the providers you already use, and every model call routes through the gateway on your own box. What you get for those constraints is the whole control plane on storage you back up yourself. The Postgres data directory, the storage directory and the `.env` hold the instance, and copying those three is the backup. ## Short answers before you commit a server ### Can I self-host a cloud agent platform? Yes. Kortix installs into a single Compose project on a Linux box you own, and its sessions run on Platinum. ### Is Kortix free to self-host? Yes. Self-host is free. Sandbox compute still comes through your own Platinum key, and model calls through your own provider account. ### Where do self-hosted agent sessions actually run? On Platinum sandboxes, which are not the server running the control plane. With no domain and no tunnel, they do not start at all. ## Put the control plane on your own server Start on Kortix Cloud with your own keys, or point a domain at a Linux box you own. [Try Kortix](https://kortix.com) ยท [Get started](https://kortix.com/docs/host) One isolated sandbox per session | Self-host is free | Open source. Read it, fork it, audit it.