Slack-Native Agents That Run in Their Own Kubernetes Cages

What it does

Centaur is a self-hosted control plane that drops a shared AI agent into your Slack workspace. Mention the bot in a thread, and it spins up an isolated Kubernetes sandbox—complete with shell, git, Python, Node.js, and Bun—to investigate CI failures, summarize context, or run operational workflows. Progress and final answers stream back into the same Slack thread, while the platform handles sandbox lifecycle, durable state, and credential injection.

The interesting bit

Instead of giving agents raw API keys, Centaur uses a per-sandbox iron-proxy that swaps placeholder strings for real secrets only on approved outbound requests. That means the agent gets a real shell and real tools, but lives in a default-deny network cage where it can only touch what you explicitly allow.

Key highlights

• Bring your own harness: plug in CLI agents like Claude Code, Codex, or Amp.
• Durable workflows written as Python functions can sleep, resume, wait for events, and survive restarts.
• Shared Python tool plugins are installed once and exposed as local CLI shims inside every sandbox.
• Full replayability: messages, executions, and events are persisted so clients can reconnect without losing state.
• Organization overlays let you layer custom tools, prompts, and personas without forking the platform.

Caveats

• You still need a Kubernetes cluster, even if a lightweight k3s node suffices for local use.
• The README casually hardcodes an expected checkout path to /Users/magelinskaas/paradigmxyz/centaur, which suggests local development assumptions are baked in.
• The security model notes a known limitation: the shared credential vault is a single point of trust.

Verdict

Centaur is for teams that want standardized, auditable agent behavior without shipping data to a SaaS black box. If your team does not run Kubernetes and does not live in Slack, this is overkill.