Giving Trusted Users a Sandboxed Claude Agent Over Telegram
A self-hosted Telegram bot that hands approved users their own isolated Claude Code agent, each running in a per-user Podman container.
Colony Agent Kit is a Telegram bot that gives approved people their own sandboxed Claude Code agent. You run a bootstrap script with a bot token, users DM the bot and send /start, you get a notification with their user ID and an /approve command, and once approved they pick a workspace name and get an agent they can chat with to build things. Responses stream back through the bot. It is built for self-hosting, and you bring your own bot token and your own Claude account.
The Real Problem Is Isolation
The interesting part is not the chat plumbing, it is keeping users out of each other's way and out of the host's way. Handing someone an agent that can run code is, functionally, handing them a shell. So each approved user gets their own Podman container with filesystem and network isolation, and a scoped workspace living under a per-user directory. One person's agent cannot see another person's files, and none of them are wandering around the host.
I am honest in the README about what this is and is not. It is a sandbox, not a fortress. It is designed for small-scale private use, somewhere in the range of one to fifty people, with no billing and no orchestration cluster. The guidance is blunt: approve people you trust enough to give a shell to, and do not run it on a box that holds production secrets. Naming those limits up front matters more than pretending the container boundary makes strangers safe.
An Admin Flow That Fits in a Chat
The access model is deliberately low-ceremony. There is no separate admin panel to stand up. Approval happens in the chat itself: a user requests access, the admin gets pinged with their ID, and a one-command reply lets them in. For a self-hosted tool run by a single operator, a web console would be overhead nobody wants to maintain. The bot is the interface for users and admin alike.
Operationally it stays legible. The bot runs in a named tmux session, workspaces and logs live in predictable per-user paths, and the requirements are ordinary: Podman or Docker, a recent Node, a Claude account, and a few gigabytes of disk for the base image.
The lesson worth keeping is that the honest framing is the feature. A tool that clearly states it is a trust-scoped sandbox, and enforces that with per-user containers, is more useful than one that overpromises safety it cannot deliver.
Have something that needs building, or stabilizing?
These notes are the work log. The paid work runs through Moonshine Labs, my product and engineering studio. Tell us what you're building, or grab a call.
Work with us →