[Abyss](https://abyss.scurry.io/) is my take on a local-first agent containerization framework for ACP agents. It aims to neatly solve 2 issues:

1. Agents having full access to your desktop, and thus indiscriminate access to your files/secrets/etc.

2. Agent/harness features having to be re-implemented for each agent, even if the feature isn't tied to the specific agent in any way.

The former is largely self-explanatory, I think. I want to log into my bank, I don't want my agent to even have the ability. There's a fair bit of software in this space already. I'll loop back to the advantages of Abyss' containerization vs others in a second, but the 30,000 foot overview is that Abyss runs your agent in a Docker container and proxies the ACP connection so it works with Zed/Openclaw/whatever.

The second is the more interesting and novel (as far as I'm aware). The current zeitgeist is heavily agent-specific, even for features that only read/manipulate the context (which isn't agent-specific). If you want RAG, you're writing an agent-specific plugin. If you want subagents, you're writing an agent-specific plugin even though a subsession is really just context. As a user, that can leave you tied to a particular agent just so your plugins continue to work.

Abyss solves that by taking a page from Nginx's book. Abyss supports WASM-based plugins that have full access to read and manipulate ACP messages flowing back and forth. Plugins can hide secrets in prompts from users before the agent ever sees them, implicitly hydrate prompts with RAG, inject MCP servers and more. There's a diagram showing what the flow of messages look like [in the docs](https://abyss.scurry.io/docs/guides/04-plugins/02-developing...), and there's a sample plugin [in the repo](https://github.com/SethCurry/abyss/tree/main/plugins/secrets...) that will auto-cancel a session if the agent outputs an OpenRouter API key in tool calls and responses (sample screenshot [on this page](https://abyss.scurry.io/docs/guides/what-is-abyss/#i-am-not-...)).

Plugins currently only run on the host, mostly because I haven't written something to install/distribute them inside the containers that's better than an 8GB Docker image or forcing users to make a custom Docker image.

Current Features:

- Fully agent-agnostic: pre-build images exist for Pi, Hermes, Claude and Codex but it works with any agent that supports ACP

- Supports both bind-mounting host directories and having Abyss copy files in on startup (so the agent can see them but can't change your copy)

    - Includes pathing support to mount them at the same path as on the host so your `@file.md` references still work

- Supports startup scripts, so you can add Node/Go/Rust/etc to your agent container without having to write a Dockerfile

- Manages the full Docker lifecycle; point Zed at Abyss and Abyss handles creating/stopping containers, mounting directories, etc

- Agent containers can be ephemeral or persistent

    - Persistent containers leave the agent running; running Abyss will re-connect to a running container (or create one if it doesn't exist)

    - Ephemeral containers are created and then torn down every time you invoke Abyss, giving you a consistent environment for batch-type jobs

- WASM plugins allow creating functionality reusable across agents

- Connections between your editor and the agent are encrypted and use mutual TLS for authentication

    - Certificates are ephemeral, and each container gets its own certs (they are single-use for ephemeral containers)

Future Wishlist:

- Backends other than Docker (most of this isn't Docker-specific, just a first target) - Remote backends (requires figuring out how to make something bind-mount-ish work on remote hosts)

Feedback, feature requests and bug supports are welcome!

Show HN: Abyss – ACP Agent Isolation with Middleware Support