Skip to content
oma

Infrastructure

Run fleets on any sandbox, anywhere

Concurrent sub-agent delegation, liveness heartbeats, one SandboxExecutor interface across a dozen providers — including hardware you already own.

Deployment

Two deployment paths, one codebase

Cloudflare and self-hosted Node aren't stages of a pipeline — they're parallel options. Same business logic, same API surface, pick one per deployment.

Cloudflare and self-hosted Node deployment topologies One shared codebase — HTTP routes, harness and the SandboxExecutor interface — runs either on Cloudflare as Workers, Durable Objects and Containers, or self-hosted on Node with docker compose backed by SQLite or Postgres. Both expose the same REST and SSE API. One codebase packages/http-routes · harness registry · SandboxExecutor Cloudflare managed edge Workers HTTP API · MCP proxy · cron triggers Durable Objects SessionDO · SQLite event log · SSE Containers CF Sandbox · boxrun / k8s-remote over HTTP Self-hosted Node docker compose apps/main-node same routes, mounted on Node SQLite / Postgres control plane · session runtime in-process Sandbox registry docker · k8s · e2b · daytona · subprocess identical REST + SSE surface — /v1/agents, /v1/sessions, /v1/sessions/:id/events/stream
Cloudflare
  • Workers HTTP API, MCP proxy
  • Durable Objects SessionDO, SQLite event log
  • Containers Cloudflare Sandbox, or boxrun / k8s-remote / OpenShell over HTTP
Self-hosted Node
  • apps/main-node Same route implementation as Workers
  • SQLite / Postgres Control-plane DB, agent DO logic in-process
  • docker compose Full SandboxProviderRegistry — every adapter available

Fleets

Built for multi-agent fleets

Concurrent sub-agent delegation, liveness heartbeats, and native webhook notifications to GitHub, Slack, and Matrix.

any sandbox

Run on any sandbox

Cloudflare, subprocess, E2B, Daytona, or Kubernetes. One per environment, swappable without touching agents.

cost control

Pause & resume

Snapshot the workspace and stop the container between turns; resume restores it exactly, so idle agents cost nothing.

coding agents

Coding agents inside

Run Claude Agent SDK, Grok, or any OpenAI-compatible coding agent in the sandbox, one Docker image per runtime.

delegation

Cross-sandbox sub-agents

Parent and child run in separate sandboxes, even on different providers, with parallel fan-out and result aggregation.

Cloudflare
Docker
Kubernetes
E2B
Subprocess
Browser
Daytona
OpenShell

Sandboxes

Connect any sandbox provider

One SandboxExecutor interface, a dozen adapters. Pick a provider per environment — agents and sessions never notice the difference.

Cloudflare Sandbox

Fully managed Containers — zero setup on the CF deployment.

Kubernetes

Pod-per-sandbox on your cluster via the agent-sandbox controller.

NVIDIA OpenShell

Policy-enforced agent sandboxes — default-deny egress, Landlock FS.

E2B

Firecracker micro-VMs as a service — bring your API key.

Daytona

Managed cloud dev environments — bring your account.

Docker Compose

Containers on any Docker host for the self-host runtime.

Subprocess

Zero-isolation local dev — the fastest inner loop.

Browser VM

A WASM Linux VM in your own browser tab — zero server compute.

BYOK & more

LiteBox, BoxRun, GitHub Actions, remote agents — or register your own.

Bridge

Connect your own machine

One command pairs a laptop, workstation, or homelab box with your OMA deployment. Agents then run on hardware you already own.

terminal 
$ npx @getoma/cli bridge setup

⢀⣴⠶⠶⠶⠶⠶⠶⠶⠶⠶⠶⠶⠶⣦⡀
⣿⠈⠢⡀           ⣿
⣿   ⠈⠢⡀        ⣿
⣿      ⢠⣾⣷⡄    ⣿
⣿      ⠈⠻⠟⠁    ⣿
⠈⠻⠶⠶⠶⠶⠶⠶⠶⠶⠶⠶⠶⠶⠟⠁

oma bridge  v0.1.3

✓ paired macbook-pro.local with app.oma.duyet.net
✓ daemon installed as a background service
✓ connected — heartbeat 25s, auto-reconnect on

This machine now appears on the Console's
Sandbox Runtime page.

How the bridge connects

your machine
bridge daemon
──outbound wss──▶
no inbound ports
OMA
control plane
  • Outbound-only. The daemon dials out over WebSocket. Nothing listens on your machine, no port-forwarding, works behind NAT.
  • Self-healing. 25s heartbeats with a liveness watchdog; silent drops reconnect with jittered backoff.
  • Scoped & revocable. Paired per tenant with its own token — revoke from the Console or oma runtime rm at any time.
  • Observable. bridge status shows liveness, heartbeat age, uptime, and authorized workspaces.

More on bridging your local machine or connecting a private Kubernetes cluster.