Centaur puts each chat thread in a Kubernetes sandbox
Centaur turns a Slack mention or API message into a durable agent session. The control plane stores messages and events in Postgres, assigns a sandbox, starts the selected command-line harness, and streams progress back to the caller. Claude Code, Codex, Amp, and deployment-specific harnesses can sit behind the same interface. Tools and workflows are installed centrally rather than copied into every developer's laptop setup.
Isolation is the defining choice. Each conversation receives a short-lived Kubernetes pod with a shell, workspace, Git, Python, Node.js, Bun, and common developer tools. The repository at commit 46bebdf contained 1,684 files and roughly 287,961 lines of source in 19.5 MB. That code spans a Rust API, chat services, sandbox images, Python tools, workflow plugins, a console, and Helm deployment material. This is platform infrastructure, not a Slack bot with a subprocess attached.
The first agent turn needs Kubernetes and 5 bootstrap secrets
The local guide asks for Docker, a Kubernetes cluster, Helm, kubectl, just, and jq. A lightweight k3s host, kind cluster, minikube, or Docker Desktop Kubernetes can work. The default bootstrap also expects OP_SERVICE_ACCOUNT_TOKEN, OP_VAULT, SLACK_BOT_TOKEN, SLACK_SIGNING_SECRET, and SLACKBOT_API_KEY. The default Codex harness needs an OpenAI API credential stored behind iron-proxy before it can finish a turn.
just up creates secrets, builds several local images, and deploys the chart. A smoke command then exercises the durable API without Slack and expects a completed execution containing PONG. Slack comes afterward and needs a public HTTPS webhook plus event scopes. That sequence is documented well, yet it is a real cluster deployment. If your team does not already understand pod scheduling, image builds, ingress, service credentials, and Postgres operations, Centaur creates a new operational specialty.
What happened when we ran it
Our fresh Node 22 sandbox installed 364 pnpm packages in 20 seconds and used 348 MB on disk. Dependency installation succeeded cleanly for the root workspace. The repository is a monorepo, with pnpm workspaces for JavaScript packages and several ingress bots. Other parts use Rust, Python, and Ruby, so a successful root pnpm install does not cover every language, service, image, migration, or Helm resource needed by the deployed platform.
The root package had no build script or target, so our harness skipped build. It also had no test script or target, so tests were skipped. This is not a passing build or a passing suite. The README tells contributors to build an affected service with just build-one, deploy it, and run language-specific checks such as Ruff and pytest for Python. That service-by-service approach may fit the repository, but it leaves no single root command for an evaluator to verify the platform.
The lab result therefore proves only one narrow fact: 364 pnpm dependencies resolved in 20 seconds at commit 46bebdf. It does not prove the Kubernetes stack boots, a sandbox starts, Slack delivery works, or credential substitution behaves correctly. Teams evaluating Centaur should run the documented smoke test and one real chat turn against their own cluster, then exercise the exact harness and tools they plan to grant.
Credentials stay outside sandboxes, while egress starts open
Centaur's security design addresses a difficult agent problem. Sandboxes receive placeholder strings rather than raw secrets. A per-sandbox iron-proxy substitutes a real credential only for configured hosts and approved header, query, or path positions. Kubernetes NetworkPolicy blocks a sandbox from reaching other pods or the internet directly; outbound calls go through its proxy. Messages, executions, tool calls, delivery state, and proxy activity are retained for investigation.
The defaults still require work. The security guide says iron-proxy's domain allowlist initially accepts *, so operators must replace it with the hosts their tools need. New principals also inherit an infrastructure role by default, and administrators must configure roles, grants, and sandbox capabilities. The documented model does not defend against a fully privileged attacker on the host or cluster control plane. It limits agent-originated damage inside the sandbox boundary; it does not turn Kubernetes administration into a low-trust activity.
Durable workflows justify the platform cost for some teams
A workflow can save a step, wait, resume after a service restart, run another agent, or react to an external event. That is useful for recurring checks, CI investigations, customer-context summaries, and operational jobs that cannot finish inside one HTTP request. Centaur also exposes session APIs for creating or reusing a thread, storing messages, starting execution, and replaying events. The design makes chat one client of a durable runtime rather than the sole place state exists.
Current issue activity shows why durable agent infrastructure is hard. Issue 1454 says a pod killed at a 4 GiB memory limit could be reported as a generic sandbox status instead of OOMKilled with exit 137. Issue 1489 describes a Console follow-up that reaches the active execution but then shows HTTP 500 when a second execution insert conflicts. Issue 1488 says activity summaries still require an OpenAI-style provider even when the session uses another configured model source.
Release 0.1.126 is active and still pre-1.0
GitHub recorded a push on August 26, 2026, hours after release centaur-0.1.126. The repository had 1,187 stars and 67 open issues and pull requests when fetched. The license file offers Apache 2.0 or MIT, although GitHub's repository metadata did not identify it automatically. Frequent releases and detailed technical reports show an active project. They do not make a 0.1 series a settled operational contract.
Centaur is compelling when many users need the same coding agents, tool permissions, transcripts, and resumable workflows. The price is a cluster, several services, secret policy, and no one-command root verification. Our 20-second install is the smallest part of that decision. Run it when centralized control solves an existing organizational problem. For one developer or one agent, OpenHands or a dedicated sandbox layer will usually reach useful work sooner.