Lathe: sandbox tools for Open WebUI

Lathe connects a model in Open WebUI to a Linux sandbox. The model can run commands, edit files, use a persistent Python session, delegate longer jobs, and give the user browser or SSH access. An admin installs one Python tool; Lathe provisions and reconnects one Daytona sandbox per user.

System

Four parts, with distinct jobs

Open WebUI

Hosts the conversation, model connection, and Lathe tool code.

Lathe

Translates tool calls, manages sandbox lifecycle, and returns results.

Daytona

Hosts the sandbox VM, filesystem, network access, and signed service URLs.

Your model

Chooses and calls the tools. Lathe works with models Open WebUI can use.

This arrangement puts a coding-agent workspace behind a chat interface. It does not make the workspace local or provider-free: Open WebUI, the selected model runtime, and Daytona remain part of the trust boundary.

Demo

A real session

A live conversation on a deployed Open WebUI instance. Capture source

Agentic video

An explainer made from source

This explainer was substantially developed using Lathe. Its source is available as an example of agentic video production.

Inspect the source

Working model

Files persist; processes do not

A user returns to the same sandbox across conversations. Files, repositories, and installed packages on its filesystem survive ordinary stops and archives. A new tool call starts the sandbox again when needed.

Running servers, shell processes, and in-memory Python state are lost when the sandbox stops or archives. The default configuration stops an idle sandbox after about 15 minutes and archives it 60 minutes later. Administrators can change these intervals.

Conversation context is separate from sandbox state. handoff() prepares a compact record for a new conversation; it does not copy or preserve model context automatically.

Tools

A small interface to the sandbox

bash

Run non-interactive shell commands. Long commands continue in the background.

read · write · edit

Inspect numbered line ranges and make explicit file changes.

glob · grep

Find files and search their contents without dumping a whole tree into chat.

interpret

Run Python in a chat-scoped REPL whose variables survive between calls.

delegate

Give a bounded, multi-step task to a sub-agent working in the same sandbox.

expose

Create temporary access to a web service, file browser, browser IDE, or SSH.

onboard · lathe

Load project instructions and consult the model-facing manual.

handoff · destroy

Prepare a fresh-chat handoff or, with confirmation, remove the sandbox VM.

Workflows

What to ask for

Users describe the outcome. The model decides which tools to call.

Inspect a repository “Clone this repo, run its tests, and explain the first failure.”
Build and open a service “Make a small FastAPI app and expose it so I can try it.”
Explore data “Load this CSV, inspect missing values, and plot the useful distributions.”
Transfer files “Give me a browser where I can upload files to the workspace.”
Continue elsewhere “Prepare a handoff for a fresh conversation.”

Trust and retention

Know where the work goes

Sandbox data lives in Daytona. Lathe labels each sandbox with the Open WebUI user's email. When persistent volumes are enabled, /home/daytona/volume is backed by Daytona's S3/FUSE storage.
User environment variables are credentials entrusted to the agent. Lathe injects them into model-directed shell commands. The model can print them, inspect process environments, or read generated command wrappers. Use scoped, revocable credentials.
Exposed URLs are bearer credentials. Anyone with a current dufs or code-server URL can access the service, including files or a terminal. URLs expire after about one hour; do not publish or log them.
Auto-delete and volume retention are separate. By default, neither the sandbox nor its persistent volume is automatically deleted. An admin can set sandbox deletion intervals, but a separately managed persistent volume survives sandbox destruction.
Updates are manual. Open WebUI stores the uploaded copy of lathe.py. An installed deployment does not receive fixes merely because the GitHub repository changed.

Administration

Install deliberately

Lathe is a single Python file installed as an Open WebUI Tool. It runs inside Open WebUI and receives an account-wide Daytona API key, so administrators should review the source and record the installed version.

The administrator README covers installation, valves, security, and verification. The repository also contains an explainer video for a longer architectural overview.