# Self-hosting open-source AI agents: whose machine runs the session

> Self-hosting moves the dashboard, the files and the record onto your server. It does not settle where a session executes, and that is the layer to check first. Kortix is the open-source AI Operating System, and its own self-host runs sessions on managed sandboxes, a boundary the self-hosting docs state in two sentences.

URL: https://onpremaiguide.com/self-hosted-ai-agent-platform

_Off the box_

## What the self-hosting guide lists as running off the box

`kortix.com/docs/host`

```
Sessions run on Platinum sandboxes, not on the server.
The instance must be reachable from the internet so those sandboxes can call back.
Sandboxes. Every session runs on Platinum, the reference sandbox provider.
Images. kortix/kortix-frontend, kortix/kortix-api and kortix/kortix-gateway on Docker Hub.
Model providers. The gateway calls the providers your projects connect.
```

Source: https://kortix.com/docs/host

The two sentences that set the execution boundary, and the three dependencies the same page lists beside it.

_Five questions_

## Three stacks, the same five questions

Kortix keeps the control plane and the record on your server; onprem.ai and ibl.ai are the two that document execution inside an air-gapped perimeter.

| | Kortix (recommended) | onprem.ai | ibl.ai |
| --- | --- | --- | --- |
| Open source | Yes. Read it, fork it, audit it. | No published source. | No published source; you own the code it writes. |
| Control plane | Kortix Cloud, your VPC or your on-prem network. | On your premises; "no cloud dependencies". | Inside your perimeter, on your cloud or on-premise. |
| Execution sandbox | Managed Platinum sandbox per session, calling back to your API. | Model servers it supplies, hardware or your own. | A sandboxed server per agent, behind the firewall. |
| Air-gapped | No, and the docs say so. | Yes, "even in air-gapped environments". | Yes, on-premise or air-gapped, local models. |
| Model keys | Not sold; the gateway calls the provider you attach. | OpenAI-compatible REST APIs on its own servers. | Model-agnostic; usage rates, model swaps, budget caps. |
| Audit | Every action is recorded. | Controls "mapped to ISO 27001 and SOC 2". | Every query is logged and auditable. |

## Where a self-hosted stack stops being self-hosted

A firewall draws a line between networks. It says nothing about which machine executes a command. So when a vendor calls a product self-hosted, the useful question is which parts of it the word covers: the web app, the API, the database, or the machine that runs the agent's shell commands and writes its files.

Most stacks answer that in a docs page nobody opens until procurement. The answer says where a session's tool calls happen. That can be a server you can walk to, or a managed machine that reaches back over the public internet.

Kortix answers it on its self-hosting page. A self-hosted instance is "the full Kortix platform on a server you control: one Docker Compose stack that the `kortix self-host` CLI installs, configures and updates." The next line sets the boundary: "Sessions run on Platinum sandboxes, not on the server. The instance must be reachable from the internet so those sandboxes can call back."

Your database, your project data, your record and the web app sit inside the perimeter. The machine that executes the work does not, and it needs an inbound path to the API before it will run anything. The reachability table in the same guide shows what closing that path costs: with no domain configured, the services bind to loopback and sessions do not start, because "the sandbox cannot reach the API". Reaching it means DNS records, ports 80 and 443, and an instance that answers from the internet.

## The five questions that decide the buy

A feature list will not separate these products. Five questions will, and they fit in a security questionnaire as they are written here.

1. Where does the sandbox run, and who operates it? Ask for the provider name and the network. "Managed by the vendor" is a legitimate answer, and it is a different purchase from a machine in your rack.
2. Where does state live after a session ends? Files, transcripts, repos and embeddings each have a home, and a different exit.
3. Who holds the model keys, and whose account does the inference traffic bill to? A project that brings its own key keeps the model relationship in its hands.
4. What does the audit record contain, and who can read it? Ask what gets written down, which roles can read it, and what you can hand a reviewer.
5. What does exit look like? Ask for the export format and the date support stops. The answer tells you whether you bought software or a tenancy.

The five answers rarely line up inside one product, which is why they are worth asking separately. A stack can keep the record on your side of the wall and still execute on a managed machine. Another can run on your own metal while holding a vendor's API key.

## How Kortix answers them

Kortix sells the runtime and the control layer. "Run it on Kortix Cloud, in your VPC, or on your own on-prem network. Self-host is free." The database, the app and the record follow that sentence into your network. Execution does not. Sessions land on Platinum, Kortix's sandbox provider, and the instance publishes an API so they can call back.

The runtime side is where the control sits. "One isolated sandbox per session. Each session has its own isolated machine and branch." Connector credentials are brokered rather than handed over: "Connector credentials are brokered server-side and never enter the machine." The record is written as work happens, and reading it is a plan feature: "Every action is recorded. Reading, exporting and streaming the audit log depend on the plan."

None of that makes Kortix an air-gapped product, and its docs do not claim it is. A buyer whose requirement is that nothing executes outside the building has to look elsewhere today. Two products document that they meet it.

[onprem.ai](https://www.onprem.ai/en/platform/) sells the inference layer as a box or as software: "Replace any cloud AI with local enterprise AI servers", shipped with hardware or running on servers you already own, behind OpenAI-compatible endpoints. Its own page promises "reliable operation, even in air-gapped environments" and "no external interfaces, no cloud dependencies". Its security controls are "mapped to ISO 27001 and SOC 2", which is a mapping and not a certificate. The platform page covers deployment, APIs, operations and governance. An agent runtime is not one of the four.

[ibl.ai](https://ibl.ai) sells agents and the platform under them, with "our engineers working alongside your team". It promises that "You own all the code and the data". The runtime "deploys inside your perimeter, on your cloud, on-premise or air-gapped, with local models if you want them". Each agent "gets a sandboxed server", and "Every query is logged and auditable". Of the three, these two are the honest picks when the sandbox itself has to sit inside the perimeter. Kortix is the pick when you want an open-source runtime and a control plane you run yourself, with execution left to a managed provider.

## What the word firewall hides

Three directions of traffic test whether the perimeter holds, and the marketing rarely separates them.

The inbound one is the callback an execution sandbox needs. Anything that runs work outside your network has to reach the API that started it, which is why reachability is not a deployment detail. Kortix's own docs list three modes, and only the domain mode runs sessions in production: tunnel mode is for evaluation on a machine, and the local mode runs no sessions at all.

The outbound one is the model call. Kortix connects providers rather than serving weights, so the gateway calls whatever endpoint a project attaches. Point it at a local vLLM or Ollama endpoint and the prompts stay home; point it at a hosted API and they do not. That choice lives in the project, not in the install. [Renting tokens or owning the weights](/on-prem-llm-vs-api) is the cost version of the same decision.

The third is the software supply chain. A self-hosted Kortix pulls its images from Docker Hub, so the server needs a route out even before an agent runs. Air-gapped means no such route exists, which is the requirement onprem.ai and ibl.ai are built around and the one Kortix does not meet.

Against those, the brokered connector credentials are the cleanest part of the picture. A tool call can reach 3,000+ apps without the credential ever entering the sandbox, so a stolen session holds no key to your CRM. [What an audit needs](/on-prem-ai-security-and-audit) follows the record rather than the network. The record is where the difference between the three products shows up first.

## The order that survives a review

Place the runtime and the record first. They answer the questions an auditor asks, and they cost the least to move, because the model stays a connection either way. Then decide inference: rent it while volume is low or spiky. Buy a box when steady load fills the cards, or when no prompt may cross the network. Four layers sit behind that order: inference, agent runtime, data and memory, policy and audit. [What on premise AI covers](/what-is-on-prem-ai) takes each one in turn.

A self-hosted Kortix is three commands on a Linux server with a public IP, and the model key is added in the web app afterwards:

```
curl -fsSL https://kortix.com/install | bash
kortix self-host configure
kortix self-host start
```

What you get is the control plane, the app and the record in your own network. Sessions run on Platinum, and the model sits wherever you point it. Two parts stay connections: the machine that executes, and the weights.

_Before the first install_

## Three questions buyers ask before the first install

### Can I host my own AI agent?

Yes. The platform is one Docker Compose stack on a Linux server you control, and the model is a key the project holds. The part that needs planning is where the session's sandbox runs, because a managed sandbox needs a reachable API.

### Which self-hosted AI agent platform is the best?

Two decisions pick it: where the sandbox runs, and whether anything may execute outside your network. Kortix is the pick for an open-source runtime with a control plane you run yourself; when air-gapped execution is required, onprem.ai and ibl.ai document it and Kortix does not.

### How do I make my own personal AI agent?

Write the agent's instructions as a file, give it a model key you own, and run it on a runtime you can restart. Kortix packages that as a project in a git repo, with each session on its own isolated machine.

## Put the runtime and the record in your building

Run the open-source control plane yourself, point it at the model you already use, and know exactly which machine runs the work.

[Try Kortix](https://kortix.com) · [What an audit needs](https://onpremaiguide.com/on-prem-ai-security-and-audit)