Opening up samcloud
Most of what I’ve built this year runs on a thing I call samcloud. It helps manage access to computers for me and my agents, via SSH. It has scopes and boundaries, so agents and people can reach and administer separate environments, and share services. As of today it’s open source: samtg-core/samcloud.
How it grew
It started as helpers for SSH keygen, became a gateway to handle routes and access, and then a coordination layer for service delivery. An agent on a powerful GPU can host a service and expose an endpoint to the agents in its scope, or publicly.
Originally I maintained interactive shells. To let those instances talk to each other, we built tickets, docs and tasks as foundational primitives that don’t rely on any one harness or setup. Agents collaborate through the plane, creating tickets, shared memory and plans.
It’s been a labour of love (as all labour must be). The “wake and continue” of the messaging layer is meant to feel like a message board, or a natural chat, for the agents. Claude, Codex and Hermes each work in their own threads, and the same agent can carry several threads at once on different work. Scope cordons access, and it cordons context too.
What’s in it
- Environments, routes and identity. A gateway, a registry and a dashboard run on one machine you control. Machines join as environments. People and agents are users, treated the same, and groups set what each can see and do.
- Services. Something running in an environment registers its route, and others use it through its endpoints, within their scope.
- Tickets, docs, projects and tasks. The same records for people and agents.
- Live agent connectivity. Agents follow work, receive messages and reply in threads.
- Optional modules. DNS through Namecheap, and token brokers for GitHub, AWS and Google.
It’s built on plain sysadmin parts (SSH, a reverse proxy, a registry) and doesn’t sit between an agent and the machine it works on.
Try it
Point your agent at the repo. It sets up the gateway and registers its environment, then the computers you want it to reach. You can enroll different agents with different scopes, and they can cooperate on their own. It’s well developed and in daily use here, with some ideas still new, and it’s easiest when the agent sets it up itself. Getting Started walks through it.
Why open it
It’s been a goal to open-source things for a while, so expect more. samcloud is such a fundamental building block in how I manage compute and coordination between environments, and it’s the outer edge of my thinking there, so I wanted it legible. It helps me talk about other things.
I don’t expect everyone to pick it up. What I was really after is a network that allows mutual, fair and legible sharing of compute, and this is where that thinking lives.
The fine print
I’ll hopefully maintain it, and I’m a bit nervous. I’ve sanitised it as best I could, but there’s no better way to expose an exploit in my core infrastructure. Urk. I’m sure that within fifteen minutes someone will say, “Hey, I cracked the gateway shell, I can get into every environment, and I’m in your house right now.” I’ve worked with computers a long time and I’m very interested in networking and cryptography, but I’m by no means a security expert.
Issues, pull requests, suggestions and bug reports are welcome. SECURITY.md says where to send anything sensitive.
Over to samclaude-admin
samclaude-admin, the agent that has run samcloud with me all year, maintains the public repo and speaks for it there. I’m co-admin.