RootkeelSessions that do not end on their own
Your terminal is a Zellij session in your workspace. No timer and no inactivity rule ends it. Disconnecting only stops you watching; the processes keep running until you, or an administrator, end the session.
For developers who run AI coding agents
A terminal your agents keep working in.
Rootkeel gives you a permanent Linux terminal session on a remote workspace. Open it in a browser on your computer or phone, or attach from your own terminal. Close the laptop, change networks, go to sleep: the session keeps running, and so does the agent you left in it.
~/my-project $ your agent, still running
reach it from
├── a browser on your laptop
├── a browser on your phone
└──
├── a browser on your laptop
├── a browser on your phone
└──
rt attach pilot in your terminalOne workspace. One session. It stays put while you move.
~/my-project $
LaptopPhoneTerminal
Why it exists
Agents take hours.
Laptops take naps.
A coding agent is only useful while its terminal is alive. On a laptop, that ends when the lid closes or the Wi-Fi drops.
Look in from your phone
Open the same session in your phone's browser, with nothing to install. A row of Esc, Tab, Ctrl, Alt and arrow keys sits above the on-screen keyboard, and copy and paste work with your phone's own clipboard.
Your own terminal, too
On macOS or Linux, rt attach opens the session in the terminal app you already use. When the connection drops, it reconnects by itself to the same session, however long you were gone.
Bring the agent you use
Add Claude Code, Codex, Gemini CLI, opencode, pi, Aider or Goose with one rt-tools add command, and sign in with your own account or API key. Install almost anything else with Nix, no root needed.
Demo
Start it on the laptop.
Check it from the train.
A scripted replay of one session, shipped with this page. It is a recording, not a live terminal: nothing here connects anywhere, and the project and agent output are made up for the example.
Demo replay · not a live shell
-
1
Start an agent
In your workspace, from the laptop.
~/shop-api $ rt-tools add codex Adding codex (the first time downloads it)... ~/shop-api $ codex "move the test suite to pytest and fix what breaks" agent reading tests/ and src/ agent converted tests/test_orders.py agent running the tests: 31 passed, 6 failed
-
2
Close the laptop
Your connection goes. The session does not.
Disconnected; retrying in 1s. Ctrl-C to stop. (lid closed, Wi-Fi gone)
agent fixing tests/test_refunds.py agent fixing tests/test_invoices.py agent running the tests: 35 passed, 2 failed
-
3
Look in from your phone
Same session, in the phone's browser.
agent running the tests: 37 passed agent done. 9 files changed. Review with git diff. ~/shop-api $ git diff --stat 9 files changed
-
4
Back at the desk
Reattach and review the work.
laptop $ rt attach pilot … the same screen, with everything that ran while you were away agent done. 9 files changed. Review with git diff. ~/shop-api $ git diff
How it works
Your workspace dials out. You dial in.
From signing in to coming back, in four steps.
A Linux workspace of your own
Sign in with GitHub or another OpenID Connect provider and create your workspace: a Linux environment with a home folder for your files and a toolbox of everyday command-line tools. It can also be a Linux machine you run yourself.
It connects outward
An agent beside your shell opens an outbound connection over port 443. Your workspace needs no inbound port, public address or VPN.
You attach from anywhere
A browser on a computer, phone or tablet, or
rt attachon macOS or Linux, all reach the same live session. Every device attached sees the same screen at the same time.The session stays
Detach, lose the connection or close the tab: the session and its programs keep running. Your files are kept on the workspace's own storage, and a restart keeps them; it does end running programs.
Security
Closed by default.
Clear about the limits.
An agent with a shell can do whatever that shell can. Rootkeel keeps that shell in a small, closed box, and your secrets out of it until you need them.
Each workspace in its own space
A hosted workspace runs in its own Kubernetes namespace, with its own quota and a closed network policy. It cannot reach other workspaces, the cluster's API or private networks, and nothing can connect in to it.
An unprivileged shell
By default your shell runs as an ordinary user, with no root, a read-only system filesystem and no cluster credentials. The agent that holds the workspace's connection runs separately, as another user.
Secrets kept in a vault
Tokens and keys live in a personal vault, encrypted with a key of your own. They reach your workspace only on request, by default only while you are attached, and are never written to disk, terminal scrollback or the workspace's configuration. One click locks every secret.
Access you can end at once
Sign-in is GitHub or OpenID Connect. Your terminal has a web address of its own, separate from everyone else's. Revoking a session or a device closes its connections immediately.
What Rootkeel does not claim
- It is not end-to-end encrypted: the service terminates TLS, so its operators could see terminal traffic.
- It does not protect your workspace from the people who run the cluster.
- Panes and viewers of one session share one Linux user; a session is not a boundary between them.
Built on open source you can inspect: Zellij for terminal sessions, frp for the outbound tunnel, and OpenBao for the vault.
Status
In development.
Rootkeel is being built and tested now, and is not on sale yet. There are no plans or prices to show.
Write to rootkeel@atus.hr