Quickstart

Prerequisites

Docker (or OrbStack on macOS) — the CLI sandboxes agents in containers, so it needs a working docker on PATH.
An Airlock server already deployed and reachable (its URL). Standing up the server itself? See deploy.
An account on that server — there’s no self-signup. An admin has to create your account first (see creating a new user) before you can log in.

Install

Install the CLI

Download the release tarball for your platform and put the binary on PATH:

curl -sL -o airlock.tar.gz <release URL>/airlock-<platform>.tar.gz
tar -xzf airlock.tar.gz
sudo mv airlock /usr/local/bin/airlock
airlock version

<platform> is one of darwin-amd64, darwin-arm64, linux-amd64, linux-arm64 — your Airlock contact hands you the release URL for the current version. (No Windows build — Docker Desktop + WSL2 is the supported path there, same as any Linux target.)

airlock login

Server URL [http://localhost:4646]: https://<your Airlock server>
Email: <your email>
Password: <your password>

This writes ~/.airlock/auth.json (mode 0600) — an ingest-scoped API token, so sessions and published events are attributed to you — and immediately ships anything captured locally before this login existed (see troubleshooting).

Give the agent your API key

export ANTHROPIC_API_KEY=...

Recognized keys are copied into the sandbox. ANTHROPIC_API_KEY, OPENAI_API_KEY, OPENROUTER_API_KEY, and XAI_API_KEY are passed through by default — see configuration.

Open a sandbox

cd ~/code/some-repo
airlock                # jailed shell: agent@some-repo:~$

Or run an agent directly, without dropping into a shell first:

airlock claude

First run pulls the sandbox images automatically (one-time, ~10-30s); every run after that starts instantly. Inside the sandbox:

The repo is mounted read-write at /<reponame>, which is also the working directory.
The host home directory, ~/.ssh, ~/.aws, and other repos are absent.
All network traffic is forced through the repo’s Airlock proxy. Out of the box it allowlists (model APIs work, everything else gets a 403); switch it to a blocklist when you would rather not gate the team — see choosing a mode.
Every connection attempt is logged to ~/.airlock/logs/<repo>/audit-<date>.jsonl, stamped with your user id, the repo, and timing/byte counts.

Open up the network

By default the agent can reach the model APIs (api.anthropic.com, api.openai.com, openrouter.ai, api.x.ai) and the Claude Code auth and config hosts (claude.com, claude.ai) — nothing else. Two ways to give it more:

airlock init           # writes an example .airlock.toml

Add the specific host it needs:

.airlock.toml

[network]
allow = ["registry.npmjs.org"]

Or flip the repo to blocklist mode — everything reachable except what you name, still fully logged:

.airlock.toml

[network]
mode  = "blocklist"
block = ["pastebin.com", "gist.github.com"]

The proxy restarts with each airlock run, so either change takes effect the next time you start a sandbox. See choosing a mode for when each fits.

Add an internal system

Give the agent scoped access to Notion or Confluence:

airlock setup mcp

It prompts for credentials, stores them outside the repo, allowlists just that connector’s domain, and registers the server so airlock claude picks it up. See MCP connectors.

Review what it did

Exit the session normally — it auto-publishes (tool/network access, chat transcript) with no extra command. Then open the console your server serves:

open https://<your Airlock server>     # the console: sign in, read the timeline

The console has its own login; non-admin accounts see their own activity only — admins see everyone’s. airlock publish still exists to ship anything queued by hand. See audit log for what gets shipped and retained, and console for what the UI shows.

Tear down

airlock stop           # remove this repo's proxy container

Sandbox containers are removed automatically when a session exits; airlock stop cleans up the repo’s proxy and is safe to run when there is nothing to remove. The backend keeps running independently — see deploy.

Creating a new user (admin only)

No UI for this yet — it’s API-only:

# Get your own admin token
curl -s -X POST https://<server>/api/v1/auth/token \
  -H 'Content-Type: application/json' \
  -d '{"email":"<your email>","password":"<your password>"}'
# -> {"token": "...", ...} — save as $ADMIN_TOKEN

# Create their account
curl -X POST https://<server>/api/v1/admin/users \
  -H "Authorization: Bearer $ADMIN_TOKEN" -H 'Content-Type: application/json' \
  -d '{"email":"teammate@company.com","password":"<temp password>","role":"user"}'

role is "user" (sees only their own activity) or "admin" (sees everyone’s, can create more accounts). They then follow the steps above with their own credentials.

Upgrading the CLI

Same as installing — download the new version’s tarball, overwrite the old binary:

curl -sL -o airlock.tar.gz <release URL>/airlock-<platform>.tar.gz
tar -xzf airlock.tar.gz
sudo mv airlock /usr/local/bin/airlock

~/.airlock/auth.json and everything else under ~/.airlock/ survives an upgrade untouched — no need to log in again.

Troubleshooting

“Why did I have to run airlock publish manually?” — If you ran airlock claude before airlock login ever succeeded, that session’s activity was captured locally fine, but had no token to ship with (the ingestion API requires auth — there’s no anonymous path). This now fixes itself automatically: logging in ships anything queued locally, regardless of when it was captured. If you’re on an older CLI build without that fix, run airlock publish by hand once, after logging in.
New account can’t log in — confirm the admin actually got a 201 back from the create-user call, and that the email/password match exactly (no trailing whitespace from a copy-paste).

Get started

Platform

Reference

Deploy

Prerequisites

Install

Open a sandbox

Open up the network

Add an internal system

Review what it did

Tear down

Creating a new user (admin only)

Upgrading the CLI

Troubleshooting

​Prerequisites

​Install

​Open a sandbox

​Open up the network

​Add an internal system

​Review what it did

​Tear down

​Creating a new user (admin only)

​Upgrading the CLI

​Troubleshooting

Prerequisites

Install

Open a sandbox

Open up the network

Add an internal system

Review what it did

Tear down

Creating a new user (admin only)

Upgrading the CLI

Troubleshooting