Docs

Real work for your agent. None of your secrets.

Log in once, then spin up isolated pods or run agents headless - the broker keeps your credentials out of every pod.

>_zsh - poddle
# log in once - the key stays on your machine
poddle identity add work --provider anthropic
✓ authenticated “work” (anthropic)

# hand an agent a task in a fresh, secretless pod
poddle task "add tests for parseConfig" --identity work
→ pod poddle-task-9f2a up (weak) · broker attached
→ claude-code · 6 turns · editing parser_test.go
✓ done · pod torn down · no key ever entered the pod

Prerequisites

  • Podman - poddle drives Podman to create and attach pods.
  • Go 1.25+ - only if you build from source; prebuilt binaries and packages ship with every release.

Install

>_install poddle
# any platform - downloads the signed release binary
curl -sSf https://get.poddle.dev | sh

# Homebrew (macOS or Linux); trust the tap once on Homebrew 6.0+
brew tap datadir-lab/tap
brew trust datadir-lab/tap
brew install poddle

# Scoop (Windows)
scoop bucket add poddle https://github.com/datadir-lab/scoop-bucket
scoop install poddle

Linux .deb/.rpm/.apk packages ship on each release. Building from source instead? git clone, then go build -o poddle ./src/cli.

Quickstart

Log into a provider, create a pod wired to that identity, then remove it:

>_zsh
poddle identity add work --provider anthropic
poddle up my-sandbox --identity work --harness claude-code
→ my-sandbox up (weak) · broker attached · dropping you in…
poddle down my-sandbox

Local or remote, same commands

Set PODDLE_HOST to ssh://… to run the same commands against a remote host; leave it empty for local Podman. The broker runs where you invoke poddle, so your keys never travel to the remote host either.

See it work → Concepts → Command reference →