{"slug": "rcarmo-kintsugi-agents-in-the-cloud-but-cross-platform", "title": "Rcarmo/kintsugi: Agents In The Cloud, but cross-platform", "summary": "Rcarmo released Kintsugi, an opinionated fork of Lucas Meijer's AgentsInTheCloud project that runs coding agents on self-hosted infrastructure with a choice of model providers. The fork adds an embedded Draw.io editor, a scoped token-authenticated JSON management API that is disabled by default, configurable Docker release sources with private GHCR authentication and installer rollback, GitHub Copilot subscription usage and quota tracking, and tag-only releases with native AMD64/ARM64 builds. The installer defaults to the images ghcr.io/rcarmo/kintsugi and ghcr.io/rcarmo/kintsugi-system, uses EROFS by default with OverlayFS as an option for hosts lacking EROFS support, and on systemd Linux installs a private host updater unless --no-updater is passed.", "body_md": "Kintsugi is an opinionated fork of [AgentsInTheCloud](https://github.com/lucasmeijer/AgentsInTheCloud), originally created by Lucas Meijer. It runs coding agents on your own infrastructure, with your choice of model providers and tools for evaluating their work.\n\nThis fork adds:\n\n- An embedded Draw.io editor and diagram previews.\n- A scoped, token-authenticated management API.\n- Configurable Docker release sources, private GHCR authentication, pinned updates and installer rollback.\n- Word wrapping in the file viewer, including Markdown source mode.\n- GitHub Copilot subscription usage, quota information and calendar-month pacing.\n- Unattended installation and transactional admin bootstrap with private token delivery.\n- Trusted LAN proxy access with configurable preview origins, Caddy TLS termination and persistent publications.\n- Opt-in workspace LAN/private-network permissions, configurable CIDR groups and external DNS/mDNS forwarders, with restart status and security-scoped admin settings.\n- Tag-only releases with native AMD64/ARM64 builds, staged checks, shared caches and selective CI.\n\nThe name comes from **金継ぎ**, the Japanese art of repairing pottery with gold, because the original project was a brilliant way to glue together several components and I wanted to honor that approach.\n\nYou can read [this blog post](https://taoofmac.com/space/blog/2026/10/10/1200#a-coding-environment) for the motivation behind this fork.\n\nUse a dedicated Linux server with Docker. The installer defaults to `ghcr.io/rcarmo/kintsugi` and `ghcr.io/rcarmo/kintsugi-system`; matching images must be available before installation.\n\n```\ncurl -fsSL https://raw.githubusercontent.com/rcarmo/kintsugi/main/scripts/install.sh -o /tmp/install-kintsugi.sh\nbash /tmp/install-kintsugi.sh --action install\n```\n\nEROFS is the default. For a fresh installation on a host without EROFS support, use OverlayFS:\n\n```\nbash /tmp/install-kintsugi.sh --action install --storage-driver overlayfs\n```\n\nOverlayFS uses more disk space and initial provisioning I/O. Updates retain the selected driver; in-place switching is unsupported. See [storage requirements](https://github.com/rcarmo/kintsugi/blob/main/docs/automation.md#installer-setup-update-and-rollback) for kernel and image compatibility.\n\nOn Linux with systemd, setup installs the private host updater by default. Settings uses **Check now → Download update → Restart to update** for System, the app and workspace image dependencies. Existing installations need one host-installer update from a release containing the service. `--no-updater` skips it; macOS and older installations retain app-only updates.\n\nSetup asks for the app image repository and Tailscale machine name. System defaults to the app repository with `-system` appended. For locally built or separately named images, use `--app-image` and `--system-image`. Private GHCR sources accept `--registry-config FILE`. See [automation](https://github.com/rcarmo/kintsugi/blob/main/docs/automation.md) for source selection, updates and rollback.\n\nFor unattended setup and LAN access, follow the [deployment instructions](https://github.com/rcarmo/kintsugi/blob/main/docs/automation.md#trusted-lan-proxy-deployment-v002). Use the installer from the selected release tag, with matching app and System version tags. Cloning the repository does not install a running service.\n\nKintsugi provides an optional token-authenticated JSON management API for host-local or LAN automation without Tailscale. It is **disabled by default**. Configure listeners and issue scoped tokens with `apps/web/scripts/admin-bindings.ts`.\n\nScopes cover workspace lifecycle, templates and shared configuration, secrets, SSH configuration, host diagnostics, and release/update management. Every request, including `GET /openapi.json`, requires `Authorization: Bearer <token>`. The `security` scope grants administrative power, including issuing tokens; grant it sparingly.\n\nNon-loopback listeners require TLS, including listeners published through Docker. The installer publishes no admin ports unless explicitly requested with `--admin-publish IP:HOST_PORT:ADMIN_PORT`. Docker publications can bypass host firewall rules: bind to a trusted interface and enforce network filtering. See [admin setup and permissions](https://github.com/rcarmo/kintsugi/blob/main/docs/automation.md#optional-authenticated-admin-bindings) for configuration, certificates, token storage and revocation.\n\nThe normal app also supports JSON representations of UI operations for agents and Work views. Those use the app's existing access boundary and require a matching `Origin` on mutations; this CSRF check is not authentication. Agent prompting, arbitrary commands and terminal access are not exposed through admin listeners.\n\n```\nbun install\nbun run check\nbun run web\n```\n\nInternal packages use `@kintsugi/*`. Container accounts are `agent:agent`, with `/home/agent` as their home. The app uses UID/GID 1000; workspace startup aligns the numeric IDs with the host process to preserve shared-volume ownership. Existing `ATELIER_*` environment variables keep their names for compatibility.\n\nKintsugi derives from [AgentsInTheCloud](https://github.com/lucasmeijer/AgentsInTheCloud), originally created by Lucas Meijer. The original copyright and [MIT licence](https://github.com/rcarmo/kintsugi/blob/main/LICENSE) are retained. Third-party attributions are in [NOTICE](https://github.com/rcarmo/kintsugi/blob/main/NOTICE).", "url": "https://wpnews.pro/news/rcarmo-kintsugi-agents-in-the-cloud-but-cross-platform", "canonical_source": "https://github.com/rcarmo/kintsugi", "published_at": "2026-10-12 07:07:09+00:00", "updated_at": "2026-10-12 07:39:17.723400+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "ai-infrastructure"], "entities": ["Kintsugi", "Rcarmo", "Lucas Meijer", "AgentsInTheCloud", "GitHub Copilot", "Docker", "Tailscale", "GHCR"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/rcarmo-kintsugi-agents-in-the-cloud-but-cross-platform", "markdown": "https://wpnews.pro/news/rcarmo-kintsugi-agents-in-the-cloud-but-cross-platform.md", "text": "https://wpnews.pro/news/rcarmo-kintsugi-agents-in-the-cloud-but-cross-platform.txt", "jsonld": "https://wpnews.pro/news/rcarmo-kintsugi-agents-in-the-cloud-but-cross-platform.jsonld"}}