On-demand Linux computers you can hand to an AI.
Each one is a real Firecracker microVM — a full machine with its own kernel — that boots in milliseconds, does its thing, and self-destructs when it's done (or stays up as long as you want). Open source (Apache-2.0), self-hosted with your own keys. boringcomputers.com is a showcase; you run the real thing yourself.
What a Nehemiah machine looks like
One machine, everything on it — a live desktop with a real browser, a terminal with coding agents preinstalled, and an AI you can hand the whole thing to. Type "build a snake game" and it writes it, runs it, and gives you a link to play.
- A computer — a full Linux desktop (browser, terminal, apps) over VNC, or a fast headless shell.
- Coding agents preinstalled —
claude,codex,cursor,pi, plus node, python, git and internet. - An AI that drives it — say what you want. It either uses the screen (clicks, browses) or writes + runs code and hands you a live URL.
- Files & ports — drag files in and out; open any port through the daemon.
- Fork — clone a running computer, exact live state and all, in ~35 ms.
- Storage — persistent volumes (S3-backed) that outlive a machine.
- Ephemeral or not — machines self-destruct on a TTL by default; flip keep alive and one runs until you stop it.
Nehemiah runs as a managed cloud: hosts are provisioned from signed release
artifacts onto machines the control plane enrolls, not from a local source
build. The supported path stands up one approved
Latitude.sh bare-metal host from a published v<version>
release:
git clone https://github.com/boringcomputers/nehemiah
cd nehemiah && npm install
# provision one managed host from a signed release (needs operator inputs — see the runbook)
infra/latitude/provision.sh --config "${XDG_CONFIG_HOME:-$HOME/.config}/nehemiah/latitude-host.env"Follow infra/latitude/README.md for the full
managed-host runbook: the signed-release trust boundary, the one-use enrollment
grant, the WireGuard overlay, and the canary checks to run before admitting
workloads. Tear a host back down (and stop billing) with
infra/latitude/teardown.sh.
The earlier self-serve one-command installers are no longer supported.
infra/setup.sh(a Linux box over SSH) andinfra/local/setup-local.sh(an Apple Silicon Mac in Lima) built the host from source, but host bootstrap now installs Firecracker, the jailer, and the kernel only from signed managed-release artifacts, which those scripts cannot supply. They now exit with a pointer to the managed runbook above.
Then run the site against your host:
# apps/web/.env
PUBLIC_NEHEMIAH_URL=http://YOUR_HOST_IP:8080 # or a tunnel — see apps/web/.env.example
npm run dev -w webFull REST + WebSocket API in the docs.
From any AI — an MCP server
(nehemiah-mcp) lets Claude Desktop, Cursor, and other
agents spin up and drive your computers as a tool:
{
"mcpServers": {
"nehemiah": {
"command": "npx",
"args": ["-y", "nehemiah-mcp"],
"env": { "NEHEMIAH_URL": "http://localhost:8080" }
}
}
}There's also an Effect-native TypeScript client,
nehemiah-sdk (npm install nehemiah-sdk).
Real hardware-virtualized isolation — a kernel per machine, not a shared
container. Each VM is jailed and resource-capped, restored from a memory
snapshot in ~3 ms, and self-destructs on a TTL (or runs until you stop it, when
the server enables NEHEMIAH_ALLOW_PERSISTENT). Guests are network-isolated
behind an egress firewall. The host daemon is nehemiahd/ (Go);
hosts are provisioned from a signed release via the managed runbook
(infra/latitude/).
A Turborepo monorepo (npm workspaces):
apps/web/ the site — SvelteKit
nehemiahd/ the host daemon — Go, runs the microVMs
packages/sdk/ nehemiah-sdk — Effect-native TypeScript client
packages/mcp/ nehemiah-mcp — MCP server
infra/latitude/ managed-host provisioning (provision/teardown), image builds, networking
npm install # all workspaces
npm run dev # the site
npm run build # production build
npm run check # type-check
npm run lint # prettier + eslintContributions welcome — see CONTRIBUTING.md. Licensed under Apache 2.0.