Introduction

DevCell is a self-hosted development fabric for humans, IDEs, and coding agents. Point it at a repository and get a durable remote workspace with an explicit security boundary, typed lifecycle, and familiar devcontainer workflow.

The idea

Modern development tools do more than edit files. They install packages, run arbitrary project code, start servers, request credentials, and open network connections. Containers make those environments repeatable, but they do not necessarily make them a safe trust boundary.

DevCell moves each workspace into a cell: a managed development-machine identity owned by a trusted DevCell Host. The current appliance demo can run that cell with Docker; the production boundary uses Firecracker and CellOS for a dedicated guest kernel.

inputRepositorydevcontainer.json

→

boundaryIsolated cellCellOS machine

→

clientsYour toolsIDE · terminal · agent

DevCell Hostpolicy · lifecycle · events

What DevCell owns

Concern	DevCell responsibility
Isolation	Establish the strongest boundary supported by the selected backend and report it honestly
Environment	Resolve the project’s devcontainer workflow inside the cell
Access	Broker sessions, ports, routes, and credentials through policy
Lifecycle	Create, start, stop, snapshot, fork, and destroy cells
Observability	Record durable operations, steps, events, and audit context

Project configuration can request capabilities. Only the host can grant them.

The product in four layers

Clients          CLI · Swift app · IDE · agent
                    ↓ typed Connect API
Control plane    celld · operations · policy · audit
                    ↓ backend contract
Machine          CellOS · cell-agent · workspace runtime
                    ↓ project contract
Workload         devcontainer · Compose · builds · services

The public demo already exercises a real repository path on the container-backed appliance: browser pairing, clone, workspace planning, devcontainer startup, guest exec, Cursor attach, private ports, checkpoints, forks, and cleanup. The Firecracker path implements process launch, TAP and vsock lifecycle, jail staging, and restart reconciliation; a freshly built CellOS image with the listening guest agent closes the live workspace slice inside the microVM.

The golden path

1. Select a repository and branch.
2. Ask the DevCell Host to create a cell.
3. Follow the durable operation until the cell is ready.
4. Connect an IDE, terminal, or coding agent.
5. Snapshot, fork, stop, or destroy the workspace through the same API.

Start with Features, learn the Key Concepts, or trace the full request path in System Architecture.