OpenHands local code: 78k stars, real limits

With more than 78,800 stars and 367 open issues, OpenHands dominates the open-source coding agent environment as of June 30, 2026. The core is free under the MIT license and runs every generated command inside a sandboxed execution flow on hardware you own, so source code never leaves your perimeter. What the free tier withholds is governance: SSO and RBAC sit behind the commercial license, and the container hardening a managed vendor would bundle falls entirely to the operator.

The project's velocity is undeniable, yet the operational reality demands scrutiny. All Hands AI, Inc. Operates this VC-backed initiative, which AI Agents News rates 4 out of 5 on self-hosting complexity, reflecting the heavy lift required to maintain untrusted code isolation. While the core allows engineers to run models locally without per-task metering, the absence of audit logs and LLM budgeting in the free tier presents a hard ceiling for organizational adoption. We examine how the cloud-1.46.2 release attempts to bridge this gap while keeping source code within user-managed perimeters.

Understanding these trade-offs is necessary for any team considering autonomous development tools. This analysis provides the clarity needed to navigate the divide between individual experimentation and enterprise-ready infrastructure.

The Role of OpenHands in Modern Autonomous Software Development

OpenHands as a Sandboxed Autonomous AI Software-Development Agent

OpenHands operates as an autonomous AI software-development agent that plans, writes, and debugs code inside a sandboxed Docker runtime. This definition distinguishes it from interactive coding assistants by its capacity to iterate independently until tests pass. Users deploy the system to resolve specific GitHub issues, handing the agent a task description rather than line-by-step instructions. The architecture enforces isolation by executing all generated code within containers, ensuring that untrusted model outputs cannot compromise the host filesystem. The project has accumulated over 78,800 GitHub stars as of June 30, 2026, signaling strong developer interest in self-hosted automation.

Local file mounts bind the sandboxed Docker runtime directly to the host filesystem, ensuring generated source code never traverses external networks. This configuration uses Docker volumes to persist state while maintaining strict isolation boundaries for untrusted model outputs. Organizations scaling this architecture deploy on Kubernetes clusters to manage concurrent agent workflows without sacrificing data residency controls. By routing execution through local mounts, the system eliminates the latency and exposure risks inherent in cloud-hosted sandboxes where code must upload before processing. A tangible benefit for individual developers is the zero software cost model, requiring payment only for underlying LLM API tokens rather than platform subscriptions. However, this self-managed approach shifts the entire security burden to the operator. Unlike SaaS alternatives that bundle governance, self-hosted teams must manually engineer RBAC and audit logging if they require them, as these features often reside behind commercial licensing tiers.

OpenHands MIT Core Versus Devin and Cursor Cloud Dependencies

OpenHands distinguishes itself from cloud-dependent rivals by executing code within a local sandboxed Docker runtime rather than remote vendor infrastructure. This architectural choice fundamentally alters data sovereignty compared to the proprietary incumbent Devin, which operates as a fully cloud-hosted service with no self-hosting path. While Devin functions as a benchmark-setting autonomous engineer, its model restricts source code residency to the vendor's perimeter and imposes per-task metering fees. Similarly, Cursor offers an AI-native IDE experience with agent modes optimized for speed, yet it routes code context through external clouds, creating potential exposure for sensitive intellectual property. In contrast, OpenHands uses a LiteLLM-based provider layer to support interchangeable models like Claude or GPT-4o without locking users into a single vendor system.

The core platform remains free under the MIT license, allowing unrestricted modification, though advanced governance features like SSO and RBAC require the commercial Polyform Free Trial license. Self-hosted deployments incur zero software licensing costs, requiring only the user's own compute infrastructure and API keys. However, this sovereignty introduces a tangible operational trade-off: teams must manage their own container security and model configuration upkeep. Unlike managed services where updates are smooth, self-hosted agents demand rigorous maintenance of the Docker volumes and isolation policies to prevent untrusted code execution risks.

Inside the OpenHands Architecture and Sandboxed Execution Flow

Docker Sandboxing and Kubernetes Native Runtime Mechanics

OpenHands spins up a sandboxed container to execute LLM-generated code, preventing arbitrary commands from damaging the host system. This isolation mechanism relies on Docker for local execution, creating a secure boundary between the agent's actions and the underlying infrastructure. The architecture separates the planning logic from the execution environment, ensuring that model outputs undergo validation within a confined space before affecting local file mounts. For organizational deployments, the system shifts to a Kubernetes-native runtime designed for concurrent, isolated agent sandboxes. This enterprise configuration allows multiple agents to operate simultaneously without cross-contamination risks, scaling beyond the single-machine constraints of local CLI usage. While local setups offer immediate sovereignty, the distributed nature of Kubernetes introduces complexity in networking and persistent volume management that teams must address.

The critical implication for builders is that self-hosting transfers the entire security burden to the operator. The team owns container isolation and RBAC configuration, so sovereignty here is a matter of operational discipline rather than software installation.

CLOUD Act Exposure and Remote Code Execution in Self-Hosting

US domicile for All Hands AI, Inc. Ensures any managed service use carries inherent CLOUD Act exposure. Self-hosting the MIT core removes vendor-held data from scope entirely, leaving nothing in the vendor's hands to subpoena. The operational burden shifts completely to the deployment team regarding container isolation and runtime hardening. A misconfigured sandbox presents a direct remote-code-execution risk where arbitrary commands could compromise the host system. Operators must secure the sandboxed Docker runtime to prevent lateral movement from agent tasks. Unlike SaaS models where security is bundled, here the user owns the failure mode if isolation breaks. The following table contrasts the liability models:

This architecture demands rigorous validation of Docker configurations before production use. Teams lacking deep container security expertise face higher operational risks than those using governed proprietary clouds. Sovereignty requires accepting full responsibility for the security posture of the runtime layer. Builders must verify network policies and resource limits manually, since the trade-off for data control is the elimination of vendor-side guardrails. Organizations must decide if their internal controls match the threat model of autonomous code generation. This model suits teams with mature DevSecOps practices ready to enforce strict boundaries. Casual adopters may find the required diligence exceeds their current security maturity.

Validating Container Isolation and RBAC Hardening Requirements

Operators must verify container isolation boundaries to prevent arbitrary code execution from compromising the host system. Since OpenHands executes untrusted LLM output, the security posture depends entirely on how strictly the runtime environment restricts file system access and network egress. Running the MIT core on your own hardware keeps code inside your perimeter, yet this sovereignty transfers the full burden of sandbox hardening to the deployment team.

To validate these controls, engineers should execute the following checks:

1. Confirm the sandboxed Docker runtime rejects commands attempting to access host-level binaries.
2. Verify that data persistence settings do not retain sensitive tokens in ephemeral layer caches.
3. Test RBAC policies by attempting unauthorized API calls from within the agent context.

Deploying and Integrating OpenHands Across Local and Enterprise Environments

Implementation: Installing OpenHands and Routing Models via LiteLLM

Installation requires Docker as the core dependency to spin up sandboxed containers for executing LLM-generated code safely. Operators initiate the agent via CLI or web UI, pointing the configuration to local LLM API keys or on-premise models. This local execution model ensures source code remains on local mounts, preventing data exfiltration common in cloud-native competitors. However, single-machine concurrency hits hard limits when scaling beyond individual developer use cases.

Pointing OpenHands at local models or specific API keys defines the operational cost structure. Users configure the config.toml file to route requests through LiteLLM, enabling smooth switching between on-premise inference and cloud endpoints. This flexibility allows teams to run the Free MIT core while paying only for underlying compute resources or token consumption.

1. Define the model provider string in the configuration file to target local endpoints like Ollama or vLLM.
2. Input personal API credentials for cloud providers to avoid shared tenancy risks.
3. Verify sandbox isolation ensures code stays on local mounts during execution.

Self-hosted deployments incur zero software licensing costs, requiring only the user's infrastructure. Conversely, relying on frontier models for complex tasks shifts spend to metered API tokens billed by the model provider. The strategic advantage lies in this cost-effective local development model, where small teams access advanced capabilities without enterprise subscription overhead. However, managing local GPU memory limits creates a hard ceiling on context window sizes that cloud APIs do not share. Operators must balance the sovereignty of local execution against the raw scaling power of remote inference. This approach preserves data sovereignty while strictly controlling expenditure on external tokens.

Implementation: Verifying Volume Mounts and Container User Permissions

Verify that code stays on local mounts before granting the agent network access to prevent data exfiltration. Operators must confirm the Docker volume mapping restricts write permissions strictly to the assigned project directory. This configuration ensures that arbitrary commands executed by the agent cannot damage the host system or access sensitive host files. However, local Docker limits concurrency, creating a bottleneck for teams requiring parallel task resolution across multiple developers.

1. Inspect the docker-compose.yml file to validate volume mount paths match the intended workspace.
2. Confirm the container user ID does not match the host root user to prevent privilege escalation.

Neglecting these checks leaves host files and the project directory reachable from agent tasks.

Strategic Decision Framework for Adopting OpenHands in Team Workflows

Open-Core Trap: MIT Core Versus Polyform Enterprise Controls

The MIT license grants perpetual freedom for the core agent, yet organizational governance triggers a strict commercial boundary under the Polyform Free Trial terms. Teams can deploy the sandboxed runtime indefinitely without cost, but integrating SSO, RBAC, and audit logs for multi-user coordination requires a paid license after a specific usage window. The enterprise licensing threshold permits free evaluation of these controls for only 30 days per calendar year before mandating a commercial agreement.

This architectural split forces a binary decision: engineering teams must either construct custom governance wrappers around the open-source base or accept the enterprise tax to access native policy enforcement. Unlike purely open alternatives, the commercial tier gates necessary security primitives rather than charging for support or hosted compute alone. The consequence is clear for builders; adopting OpenHands at scale without building internal identity management systems necessitates budgeting for the proprietary layer immediately after the trial expires.

Sovereignty at Scale: Building Controls Beyond Individual Development

Individual developer freedom requires additional engineering to meet team-scale security needs because sandboxed runtime isolation on personal machines lacks centralized governance. Sovereignty is real for a single engineer; at organizational scale, you either build those controls or buy them. However, the open-core trap emerges when teams attempt enterprise scale deployment without commercial licenses. The core allows cost-effective local development with zero software fees, yet scaling this to a department introduces unmanaged risk.

The limitation is that infrastructure control shifts the burden of container hardening and RBAC implementation entirely to the operator. No vendor insurance covers a sandbox that the operator misconfigures. Consequently, teams asking if they should use OpenHands for team deployment must recognize that the free tier does not include the guardrails necessary for production. The operational reality dictates that true sovereignty demands paying the enterprise tax for Polyform Free Trial gated features. Without these paid controls, scaling autonomous agents creates a fragmented security posture that contradicts the goal of data protection.

Cost Structure: Devin Metering Versus Self-Hosted Token Spend

Devin requires a monthly subscription plus metered per-task compute (ACU) consumption, creating a variable cost structure that scales with usage volume. OpenHands diverges by offering a free MIT core where teams pay only their own LLM API tokens or local model compute, effectively capping marginal costs at raw inference rates. This model enables cost-effective local development for small teams who can absorb the operational overhead of maintaining their own infrastructure.

Meanwhile, the financial trade-off shifts from operational expenditure to capital expenditure on engineering time. Organizations choosing the self-hosted path exchange predictable subscription fees for the burden of securing the sandboxed runtime and managing container isolation. While Devin bundles these complexities into its price, OpenHands users assume full responsibility for remote-code-execution risk mitigation. Teams should deploy OpenHands when code sovereignty and long-term unit economics outweigh the immediate convenience of a managed service. The enterprise tier becomes necessary only when governance controls like SSO and audit logs are mandatory, triggering the commercial license requirement. AI Agents News recommends this architecture for teams with existing Kubernetes maturity seeking to eliminate vendor lock-in while retaining model flexibility.

References

• OpenHands Review (2026): 70K Stars. Worth the Setup?: OpenHands
• Deploy OpenHands on GPU Cloud: Self-Host the Open-Source AI
• OpenHands - Features, Pricing & Review [AI Agent (Coding)]