Create an organization, connect a server
Sign in with an email code, create your organization, then run three commands on a machine you own and it becomes a free Connected Server for sessions.
Getting started with a self-hosted sandbox for coding agents takes one sign-in and three commands. You sign in with an email code, create an organization, and pair a machine you own as a Connected Server. From then on every session you launch runs in an isolated sandbox on that machine, for free, and the web app at isolation.cloud is the control surface.
Sign in with an email code
There is no password. Enter your email address, read the code from the mail that arrives, and type it in. The first time, the app asks for a display name, which is how teammates will see you.
Create the organization
An organization is the tenant. It owns the servers, the invitations and the prepaid balance; members launch sessions of their own workspaces on its servers. Every account belongs to at least one, and a solo developer is an organization of one, so you create one even if nobody else will ever join.
The form asks for two things: a name and an address. The address is the slug that goes into every URL the organization's members use, so pick it deliberately. If someone already invited you, their invitations appear above the form and you can join theirs instead, with the role they chose.
Connect a server you own
Open the Servers page and choose New Connected Server. The dialog shows a short pairing code and waits. On the machine you want to use, with Docker installed, run:
curl -fsSL isolation.cloud/server/install | sh
isolation-server up
isolation-server connect <code>isolation-server up is the whole server in one command: it pulls the server image and starts one container on a Docker volume that holds everything persistent, with the pinned OpenSandbox runtime and the tunnel client inside. The server listens on 127.0.0.1:8090 and nowhere else; the runtime itself is only reachable from loopback.
isolation-server connect <code> pairs the running server to your organization. The code works once and expires in minutes, and it is redeemed by the machine, not by your browser: the reply is that server's own credential, which never travels through the web app. On a deployment other than app.isolation.cloud the dialog adds a --backend <url> flag to the command for you.
Within a few seconds the dialog closes and the server appears on the Servers page. It goes green when its first heartbeat arrives. From that moment it has no public address at all. A private tunnel with no ingress and no DNS carries the control traffic, and view bytes go from your browser through the server's doorman into the sandbox without touching Isolation Cloud. How that is put together is in tunnels, the doorman and what is public.
Other verbs on the same CLI: isolation-server status, isolation-server logs, isolation-server update, isolation-server down and isolation-server disconnect.
Or create a Cloud Server
If there is no machine to spare, or the one you have is closed for the night, choose New Cloud Server instead. Pick Cloud sessions, a region and a size and it exists immediately, at no cost while idle. Each session you launch on it gets its own machine, billed by the second from the organization's prepaid balance while it runs. Pause or finish the session and the charge stops. The server software is identical on both kinds; only who owns the hardware and who pays for it differ. Details are in Cloud Servers and billing.
Invite a teammate
On the Team page, enter an email address and a role. A Member launches sessions of their own workspaces on the organization's servers. An Admin also manages servers and invitations and can stop any session on the organization's servers, though never open one. An Owner handles billing and can delete the organization; only an Owner can invite another Owner.
The invitation arrives as a link by mail. If it is not opened, it waits in-app at the person's next sign-in, and inviting the same address again simply re-sends it with a fresh link. Roles and what each one can see are in organizations, roles and invites.
Pairing and inviting are also chat commands, /pair and /invite <email>, once the organization installs Slack or Teams. A pairing code is only ever answered in a direct message, because whoever has it can add a machine to your organization.
With a green server on the Servers page, you are ready to launch your first session.
Questions
Do I need to open a port or set up a domain for my server?
No. After pairing, the server has no public URL. It keeps listening on 127.0.0.1:8090 and a private tunnel carries everything, so there is no firewall rule, no DNS and no inbound port.
Does a Connected Server cost anything?
No. Connected Servers never bill. Only Cloud sessions and dedicated Cloud VMs are metered — per second a session runs, per hour a VM is up — from the organization's prepaid balance.
Can I use Isolation alone, without a team?
Yes. Every account is an organization; a solo developer is an organization of one. Invite members later if you want to.