Image: GitHub
Why it mattersA developer who gives a coding agent full access to their machine is one bad prompt away from a wiped home directory, and a desktop app that keeps each agent in its own container limits what one of them can touch.
Running a coding agent on your own machine usually means handing it the user account you log in with. A bad prompt or an unlucky tool call can then reach anywhere your files live. Touri, an open-source desktop app at version 0.3.0, keeps each agent in its own container and gives it a scoped workspace, a browser and a scheduler of its own. The GitHub repository reports 83 stars and 11 forks in the five days since it was created.
The project is published under Apache-2.0 by the touri-ai organisation on GitHub. The README opens with the pitch: "touri is a local-first desktop app for macOS, Linux and Windows for running persistent AI teammates ('bots') on your own Codex, Claude Code or OpenCode CLI. Everything runs on your computer: your conversations, memory, routines and secrets never leave the machine unless you explicitly configure a remote."
One bot, one container, one workspace
A bot in Touri is a long-lived agent with its own instructions, its own memory and its own files. The user starts a bot, holds a chat with it over many sessions, schedules it to run on a cron timer, and watches it work through a window the app keeps alongside the chat. Three runtimes are listed in the README: OpenAI's Codex CLI, Anthropic's Claude Code and the OpenCode CLI. A fourth, the user's own API key against a chosen model, is also supported.
Isolation is per-platform. On macOS, Touri uses Apple's native container facility. On Linux, it runs the bot inside rootless Podman or Docker. On Windows, the README is honest that there is no host-level isolation yet. A bot's files, memory and tool outputs sit inside the container and do not share the host's ~.
What the README calls pre-release
Four limits in the README, each a reason to read before installing. The macOS build is pre-release, needs macOS 14 or newer and ships unsigned, so Gatekeeper rejects it on first open. The Linux arm64 packaging and runtime are described as "pending", so an arm64 user is on the untested path. The Windows installers are unsigned MSI and EXE, and host computer control is unavailable there. On Linux, the host computer-use panel is hidden and the live container onboarding "could not be verified" in the current build.
The app also runs an MCP server of its own, which the README names touri. Another coding agent on the same machine, such as Claude Code or Cursor, can address a Touri bot by name through MCP and ask it to run a task. That is useful if the user keeps one agent as the main one and lets it delegate to specialised bots, and it is a sharing of data the user has to turn on knowingly.
For a developer who already runs a coding agent against their repository every day, the practical question is whether the time to set up a container per bot is worth the limit on what one bad step can reach. The answer depends on how much lives in the home directory the agent sees today.
Source
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
