Tenki

Run your agents in a Tenki sandbox — a Firecracker microVM with its own kernel — using the same agentbox commands as a local box. tenki is a community provider — a plugin published as its own package (@tenkicloud/agentbox-provider), not bundled into the CLI. You get in-box Docker, a public HTTPS preview URL per port, free pause/resume, and id-addressed checkpoints, with no local Docker needed.

Switch per box with --provider tenki, or pin it project-wide with box.provider: tenki in agentbox.yaml. Comparing options? See the built-ins local-docker, hetzner, daytona, vercel, and e2b.

Install

Install the plugin, then register it so --provider tenki resolves:

npm i -g @tenkicloud/agentbox-provider
agentbox plugin add @tenkicloud/agentbox-provider
agentbox plugin list            # → tenki … (SDK v2)

A plugin runs in-process with full host and credential access, so plugin add is the trust boundary — see build-a-provider.

Credentials

Create a workspace auth token in your Tenki dashboard and expose it as TENKI_AUTH_TOKEN. On a terminal the first create prompts for it and saves it for you:

export TENKI_AUTH_TOKEN=tk_...   # or add TENKI_AUTH_TOKEN=… to ~/.agentbox/secrets.env
agentbox doctor                  # shows the `tenki:` group

TENKI_API_TOKEN is accepted as an alias. Credentials persist to ~/.agentbox/secrets.env; project .env files are never harvested. See environment.

Base image

Like every AgentBox cloud provider, a box needs the AgentBox runtime (agentbox-ctl, node, the agents) present in the image. Tenki boots from a snapshot, so the plugin bakes one:

agentbox prepare --provider tenki

prepare boots a throwaway builder sandbox from Tenki's base image, installs the runtime, tmux, Docker and the coding agents, snapshots it, and pins the snapshot id to ~/.agentbox/tenki-prepared.json. Every create then boots from that snapshot, so new boxes are ready in seconds. A repeat prepare reuses the pinned snapshot unless you pass --force, and re-bakes by itself if the snapshot has been deleted from the workspace.

prepare also bakes your host's static agent configuration into the image — settings, MCP servers, plugin registries — so boxes start with your own setup. Credentials are deliberately not baked; AgentBox seeds them per box at create time.

Use it

agentbox create --provider tenki
agentbox tenki claude            # sugar for `claude --provider tenki`

The workspace is seeded from a host git clone plus your stash and untracked files (see teleport-a-project), checked out on branch agentbox/<box-name>. From there, run an agent and access your box as usual.

Pause / resume

Tenki pause/resume is free and native, the same model as e2b and vercel. The host keepalive pushes the session deadline forward while the agent is working, so a long session is not reaped at the create-time limit.

agentbox pause <box>
agentbox start <box>

Checkpoints

Cloud checkpoints map to id-addressed Tenki snapshots (same shape as vercel and e2b). Boot from one with --snapshot, which restores /workspace intact and skips workspace seeding:

agentbox checkpoint create --name setup
agentbox create --provider tenki --snapshot setup

Pair that with box.defaultCheckpoint so repeat creates boot from your project-ready snapshot.

Specs

Configuration

AgentBox does not add per-provider config keys for plugin providers, so tenki reads the generic keys plus its own environment variables:

Caveats

• No live stats — agentbox top / dashboard render — for cloud boxes, and list reports them optimistically from the last known state.
• prune does not cover tenki — agentbox prune --provider <name> accepts built-in cloud providers only, so orphan sessions left by an interrupted create have to be cleaned up from the Tenki dashboard.
• Privileged ports — the WebProxy runs on 8080 (not 80), matching the other microVM providers; agentbox url resolves the 8080 preview.
• Push through the relay — use agentbox-ctl git push from a box; the relay holds the credentials. See sync-and-git.

Related

• core-concepts — what a box, branch, and worktree are.
• teleport-a-project — how /workspace is seeded.
• run-an-agent · access-your-box — work in a cloud box.
• web-apps-and-tunnels — preview URLs, the 8080 WebProxy, expose: ports.
• checkpoints-and-pausing — pause/resume and checkpoints.
• build-a-provider — how community provider plugins work.