Self-host

Run a drive on your own machine.

A drive is your team's shared workspace: the repo, the environment, and the agent sessions. It runs wherever you choose and connects out to coshell.ai over one authenticated tunnel. This guide covers every way to set one up and keep it running.

Your machine
$ curl -fsSL https://coshell.ai/install | bash
$ coshell host init
Your own laptop is a drive too. Teammates reach it through the tunnel while it is awake, and the doctor warns you before the machine would sleep on them.Waiting for the first command
Mac mini
$ curl -fsSL https://coshell.ai/install | bash
$ coshell host init
The Mac under the desk becomes a drive for the whole team. A launchd agent keeps it running and reconnects after a reboot.Waiting for the first command
RenderDeploy to RenderOne background worker with a 20 GB disk. The button opens Render’s template; paste your enroll token when it asks and the drive is online for the team.Waiting for the first command
RailwayDeploy on RailwayA published template on Railway. Billed by measured usage, so an idle drive stays cheap.Waiting for the first command
NorthflankDeploy on NorthflankRuns in Northflank, or inside your own AWS, GCP, or Azure account through their BYOC.Waiting for the first command
Any VM
#cloud-config
runcmd:
  - curl -fsSL https://coshell.ai/install | bash
  - coshell host init
DigitalOcean, Hetzner, Vultr, Linode, or anything that takes cloud-init. Paste one file into the machine’s user data.Waiting for the first command
Drives
acme-web
staging-box
priyas-laptop
Enrolling
PN
Priya Nair
on the drive
TR
Tom Reyes
in Rate limiter rollout
LF
Lena Fischer
on the drive
no drive yet
Access per sessionKeep a session private, share it with a few teammates, or open it to everyone on the drive.
Credentials stay on the driveKeys are configured once on the machine and scoped by the same access rules, not spread across laptops.
Identity verified at the edgeThe drive never trusts a client. The edge injects who you are, so attribution and access cannot be spoofed.

What you need

Self-hosting works on macOS and Linux, arm64 or x64. Windows runs the CLI inside WSL. The machine needs outbound internet and, if it is a laptop, a reason to stay awake while teammates are using it.

A Coshell accountSign up in the browser or run coshell signup, which creates the account, names the org, and enrolls the machine you are on as your first drive in one go.
A machine you controlYour laptop, a Mac mini under the desk, a VM at DigitalOcean or Hetzner, or a worker on Render, Railway, or Northflank. Anything that runs macOS or Linux.
Outbound network onlyThe drive binds to localhost and opens a WebSocket to the edge. Nothing listens on a public port, so there is no firewall rule to add.
Your model keys, or noneFree models are included through the OpenCode gateway. Bring your own Anthropic, OpenAI, or Google keys and they stay on the drive.

Install and enroll

Two commands. The first installs the CLI, the second enrolls this machine as a drive, asks how you want it installed, and prints the drive name when it is online.

1
Install the CLI

One line on macOS and Linux. On Windows, run it inside WSL.

$curl -fsSL https://coshell.ai/install | bash
2
Enroll the machine

Signs you in if you are not already, then registers this machine as a drive. Pick system-wide unless you want the drive inside a container: the wizard detects your container runtime and recommends resources.

$coshell host init
3
Open it

The drive shows up in the browser at coshell.ai/app for everyone on your org, and coshell attach opens the same drive from any terminal.

$coshell attach

Already signed up on another machine? coshell host init on the new one adds it as another drive. Every drive has its own name, its own sessions, and its own access list.

One click on a cloud provider

The same drive, provisioned by the provider instead of by hand. The template asks for an enroll token and nothing else. The token is never put in a link: you paste it into the provider's own environment-variable prompt as COSHELL_ENROLL_TOKEN.

RenderOne background worker with a 20 GB disk. Deploy to Render.
RailwayA published template, billed by measured usage so an idle drive stays cheap. Deploy on Railway.
NorthflankRuns in Northflank, or inside your own AWS, GCP, or Azure account through their BYOC. Deploy on Northflank.
Any VM with cloud-initDigitalOcean, Hetzner, Vultr, Linode, or anything that takes cloud-init. Paste deploy/cloud-init.yaml into the machine's user data.

Drives deployed from a cloud template receive runtime updates automatically. You do not need to redeploy.

How the drive connects

The drive listens on 127.0.0.1 only and reaches the edge over an outbound WebSocket that it holds open with reconnect and backoff. The edge authenticates every request, injects who you are, and forwards it down the tunnel. The drive never trusts a client directly, so attribution and access cannot be spoofed from a laptop.

No inbound portsNothing is published on the machine's network interface. A drive routes 401 to anything that did not come through the edge.
A per-drive secretEach drive holds its own secret, issued at enrollment. There is no global signing key on any drive.
Access per sessionSessions can be private, shared with named teammates, or open to the drive. Members only see what they have been given.
Your git, your repoWork in the drive commits and pushes to the repositories you already have. Nothing to migrate off if you leave.

Keep it running

Enrollment installs a background service: a launchd LaunchAgent on macOS, a systemd user unit on Linux. It starts at login, survives reboots, keeps the connection through idle periods, and reconnects when the host wakes.

coshell host statusIs the drive online, which port it bound, and when the tunnel last connected.
coshell host doctorChecks the machine for common problems. On a Mac it warns when the machine will sleep and disconnect the drive; sudo pmset -a sleep 0 keeps it awake while hosting.
coshell host logsTails the drive's log.
coshell host updateUpdates the drive runtime in place. Cloud templates do this on their own.
coshell host restartRestarts the service.
coshell host statsSize, compute, and disk for this drive, and a warning when the machine has less than the recommended resources.
coshell host unenrollRemoves this machine as a drive and revokes its secret.

Sizing and resources

A drive is happy on a modest machine. The runtime is a single compiled binary, and the agent's own work is whatever your project needs: a dev server, tests, a browser preview. Manage Drive in the app shows the drive's size, compute, and disk, and warns when a machine has less than recommended.

LaptopFine for a small team while it is awake. Teammates lose the drive when the lid closes, and the doctor tells you before that happens.
Mac mini or always-on boxThe usual choice for a team drive. Set it to never sleep and forget about it.
Cloud worker or VMUse this when the team spans timezones or you want the drive to outlive any one machine.

Self-host, answered

Requests from the browser or the CLI go through the edge to reach the drive, and responses come back the same way. The edge authenticates and forwards; the drive holds the repo, the environment, and the sessions. On the Enterprise tier, Coshell runs on your own infrastructure end to end.

Yes. Run coshell host init on each machine. Teams usually keep a drive per project or per client, and each has its own sessions, access list, and model settings.

Sessions pause. Nothing is lost: the drive keeps its state on disk, the service reconnects when the machine is back, and teammates resume the same session.

Yes. Choose containerized during coshell host init. The wizard detects your container runtime and recommends resources. The container publishes no ports and mounts no host paths.

Enroll the new machine, push your work through git as usual, and unenroll the old one. Sessions are per drive, so treat a move as a new drive rather than a migration.

Two commands, and your team is in.

Install the CLI, run coshell host init, and the drive is online for everyone on your org.