DeepSeek Harness

This plugin moves the DeepSeek Harness execution layer into a CreateOS sandbox. It replaces the harness's filesystem and subprocess providers together, so the existing Bash, file, LSP, and PTY consumers all operate inside the sandbox without needing sandbox-specific forks.

Both providers are backed by the same sandbox, which is what makes it coherent: a file written by one is visible to the other.

At a glance

Package: @nodeops-createos/dsh-createos
Node: ^22.19 or >=24
Auth: CREATEOS_SANDBOX_API_KEY
Sandbox lifetime: 5 minutes by default

Requirements

Node.js ^22.19 or >=24
A CreateOS API key and a compute shape
An image providing GNU base64, find, realpath, and stat, plus /bin/sh

Configuration

Bash
1export CREATEOS_SANDBOX_API_KEY='...'
2export CREATEOS_SANDBOX_SHAPE='...'
3export CREATEOS_SANDBOX_BASE_URL='https://your-createos-control-plane'
4export CREATEOS_SANDBOX_ROOTFS='...'

Variable	Required	Purpose
`CREATEOS_SANDBOX_API_KEY`	Yes	Authentication
`CREATEOS_SANDBOX_SHAPE`	Yes	Compute shape
`CREATEOS_SANDBOX_BASE_URL`	No	Control plane URL
`CREATEOS_SANDBOX_ROOTFS`	No	Base image or template

Why this one is different

Every other integration shells out to the createos CLI and authenticates with createos login. This one does not use the CLI at all — it talks to the control plane through the sandbox SDK, so createos login has no effect here and the CLI is not a prerequisite.

That is deliberate. This plugin is an execution layer mounted inside a harness process, often running headless or server-side, where a browser sign-in flow is not available. An API key is the right shape for that, and CREATEOS_SANDBOX_BASE_URL is what lets it point at a self-hosted control plane.

Install

From a checkout of the repository:

Bash
1dsh plugin --profile web add /path/to/createos-claude-plugins/packages/dsh-createos

Use --profile headless for headless runs. Once the package is published, add it by name instead:

Bash
1dsh plugin --profile headless add @nodeops-createos/dsh-createos

Running the web profile

Bash
1cd /path/to/workspace
2dsh web

Open http://127.0.0.1:3080. To confirm the execution world really is remote, ask for hostname or uname -a — you should see the sandbox's Linux hostname, not your machine's.

Ctrl+C stops the web server and destroys the sandbox.

Two things to know before you start

Your workspace is not copied into the sandbox. The plugin creates the directory it is configured to use, and nothing more. If a session selects a different absolute workspace path, that path has to exist inside the sandbox or subprocess creation fails. Two paths spelled the same way on your machine and in the box are not the same directory.

The sandbox lasts five minutes by default. A timer destroys it when the lifetime expires, and it is also destroyed when the plugin unloads. Raise lifetimeMs in the plugin configuration for longer sessions.

One mounted runtime means one sandbox, shared by every session in that web process.

What the plugin changes

Installing it disables the harness's local filesystem and subprocess providers, its host-kernel sandbox and permission presets, and puts CreateOS in their place. That is deliberate: host-kernel confinement cannot constrain a process that is running inside a microVM somewhere else, so keeping it would give a misleading impression of isolation. The sandbox boundary becomes the isolation boundary.

Persistent processes and terminals go through the sandbox's managed-process API; one-shot commands and file transfers go through the sandbox SDK.

Limits

CreateOS keeps a bounded output journal for managed processes. Output that ages out before anything reads it is gone.
Atomic writes need GNU userland and require the destination and its temporary sibling to share a filesystem.
S3 disk mounts do not get a separate filesystem namespace in the harness.
Ambiguous operations — allocation, input, resize, signal, stdin close — are never retried, since a retry could apply them twice.