Your environment
The agent works with the exact toolchain, runtimes, and local files already on your machine — no re-provisioning a fresh container each time.
Bring Your Own Computer
Bring Your Own Computer
Section titled “Bring Your Own Computer”By default, your agent runs in an Auteryn-managed sandbox on our cloud. With Bring Your Own Computer (BYO), you can instead point the agent at your own Ubuntu or Debian machine — your laptop, a home server, or an office box — and have it run code, browse the web, and work with files right there.
Available on: Internal agents on paid plans. You install a signed .deb runner on your machine; it dials out to Auteryn over a secure outbound tunnel — no inbound ports, no firewall changes.
Why use your own machine
Section titled “Why use your own machine”Your credentials
Use the SSH keys, cloud CLIs, and logged-in tools already configured on the box, instead of re-authenticating inside a managed sandbox.
Your network egress
Requests leave from your machine’s network — useful for reaching services on your LAN or behind IP allowlists.
Residential web fetch
Fetch pages from your home or office IP so sites that block datacenter traffic still load. See below.
How it works
Section titled “How it works”-
Install the runner. Download and install the signed
.debpackage on your Ubuntu/Debian machine. It registers as a background service. -
The machine dials out. The runner opens an outbound secure WebSocket tunnel to Auteryn and authenticates with a per-machine credential. Nothing listens for inbound connections on your box.
-
Bind it to your agent. In the Console, select your machine as the sandbox target for an Internal agent.
-
Run. When the agent needs a sandbox — running code, driving a browser, editing files — those actions execute on your machine and stream results back to the workspace, exactly like the managed sandbox.
Residential-IP web fetch
Section titled “Residential-IP web fetch”Many websites block or challenge requests coming from cloud datacenter IP ranges. When your agent is bound to a BYO machine, you can opt in to route the agent’s read_url web fetches through your machine’s residential IP, so those pages load as they would in your own browser.
- Opt-in per agent — off by default; you enable it on the agent that should use it.
- Browser-grade fetch — requests can impersonate a real browser’s TLS fingerprint for better compatibility.
- Internal only — guest and customer conversations never route through your machine; only your own team’s Internal-agent runs do.
- Browser agents are owner-scoped — because a BYO machine drives your real, logged-in browser sessions, only the machine owner and org owners/admins can run a BYO agent that has the Browser capability; it’s hidden from other members. (BYO agents without the Browser capability are unaffected.)
Privacy & security
Section titled “Privacy & security”- Outbound-only — the runner never opens an inbound port. It initiates the tunnel to Auteryn, so you don’t expose your machine to the internet.
- Per-machine authentication — each machine registers with its own credential, which you can rotate or revoke.
- Signed package — the
.debis code-signed; your system verifies it on install and update. - You stay in control — the machine only acts as a sandbox while the runner service is running. Stop the service to disconnect it instantly.