Should my agents get their own computer?

On Friday night I started an agent on a dependency upgrade for one of my side projects, told it to keep going until the tests passed, and closed the laptop. On Saturday morning it had done twelve minutes of work and then gone to sleep with the laptop, halfway through rewriting a config file. It picked up fine when I opened the lid. But that’s the third time this month, and it made me finally write down what I’ve been half-thinking since my New Year list.

There are two problems, and the sleep one is the smaller.

The bigger one is that my agents run on the machine I use for everything. It has my password manager unlocked most of the day, a browser signed in to my bank, SSH keys for every box I touch, and a few years of files I’d rather not lose. At work we dealt with this last spring: unattended agent runs happen in a sandbox with no credentials and a short list of hosts it can reach. On my own projects I’ve been approving every command, mostly, and I’ve noticed the “mostly” getting larger.

What I want, before I go and buy anything: it keeps running when I close the laptop, obviously. I can check on it from my phone, which means a terminal session that survives me disconnecting and reconnecting from somewhere else, so tmux or something like it. It has nothing on it I’d mind losing. Its own SSH key, its own GitHub token that can only reach the repos it needs, no password manager, no browser. If it gets messed up, I can rebuild it from my dotfiles in an hour. And it should cost about what one lunch a month costs.

Keeping the laptop awake fixes the sleep problem and nothing else. A container on the laptop is better for isolation, and it’s more or less what the work sandbox is, but it still sleeps when the laptop does.

A small always-on machine at home would be cheap after the first month, but it’d sit on my home network next to everything else in the house.

A cheap VPS. A small Linux server with a couple of cores and 8 GB of memory goes for well under $20 a month now, at the cheaper providers. It’s off my network entirely, it doesn’t care what my laptop’s doing, and if I wreck it I can wipe it from a web console and start again. This is where I’m leaning. (The work sandbox isn’t an option. My side projects don’t belong on company hardware.)

The part I haven’t worked out is how I’d reach a VPS. The usual way is SSH on a public address, with keys only and passwords off, and that’s fine, and I’ve run plenty of servers that way. But every box with SSH open to the internet gets knocked on all day, and a box whose job is to run an agent with a GitHub token on it is a slightly more interesting target than most. What I’d rather have is a server with no public SSH at all, reachable only from my own devices over a private network, a mesh VPN like Tailscale or plain WireGuard. I know that’s possible and not how it works, so I’ve been reading about it in the evenings, and that’s next week’s post.

I’ll set the thing up when I get a free weekend, which on current evidence means some time around the summer.