Choose the deployment by where your code and conversations are allowed to live, then settle the sandbox, mounts, secrets, repository permissions, and identity before OpenHands touches company code. The local open-source setup has no built-in authentication, so a team that shares one backend belongs on Cloud or Enterprise.
When you need this
- Security must approve OpenHands before engineers connect company repositories.
- A team wants to share one OpenHands backend across its laptops.
- You are choosing between OpenHands Cloud and a self-hosted Enterprise deployment.
Evaluation criteria
Deployment model
Where are code and conversations allowed to live?
Look forOpen source keeps data on one user's machine, and its docs state that the local setup has no built-in authentication or multi-tenant isolation. OpenHands Cloud keeps data in OpenHands Cloud and adds organizations and integrations. The privacy policy, effective September 3, 2025, lets All Hands AI use content and feedback from the Services to train and tune its AI models, and names an opt-out only for marketing and tracking. Enterprise runs on your own Kubernetes infrastructure, with Keycloak for identity, a LiteLLM proxy for model calls, and a runtime API that starts one sandbox per conversation.
Sandbox
What isolates the agent's commands from the host?
Look forUse Docker, the default and recommended sandbox. The process sandbox has no isolation and runs with the host user's file and command access. Cloud and Enterprise give Agent Canvas isolated sandboxes. On a local backend, start the Docker runtime so each conversation runs in its own container.
Mounts and container settings
What can the agent change on the host?
Look forMount only the project directories OpenHands needs, because it can modify or delete anything mounted read-write. Broad mounts, privileged mode, host networking, and Docker socket access all weaken isolation, so leave them off. Host-network mode also limits the backend to one sandbox at a time.
Secrets
Which credentials can a running conversation use?
Look forOpenHands can use any credential and any network access its environment offers, so give it dedicated, scoped accounts. Store those credentials in the secrets manager, which exports each secret as a sandbox environment variable and shows the agent its description.
Repository permissions
What can OpenHands write on GitHub, and where?
Look forInstall the Cloud GitHub app on selected repositories only. It requests 8-hour tokens with read and write access to Actions, commit statuses, contents, issues, pull requests, webhooks, and workflows. Turn on branch protection and required reviews on each of those repositories.
Identity, audit, and action control
Who can sign in, what is recorded, and which actions need approval?
Look forEnterprise adds SAML SSO and role-based access control through Keycloak, central audit logs, and analytics. Cloud organizations add roles, and each member's conversations stay private by default. Agents built on the SDK can require confirmation for every action, or only for actions a security analyzer rates risky. Hooks can block dangerous commands.
Questions to ask vendors
- Which backend does each team use, and which sandbox provider does it run?
- Which host directories are mounted into sandboxes, and are any mounted read-write beyond the project?
- Does any container run privileged, on the host network, or with the Docker socket?
- Which repositories can the GitHub app write to, and is branch protection on for each?
- Which secrets exist, and does each belong to an account created for the agent?
Red flags
- The process sandbox on a laptop that holds production credentials.
- A home directory mounted read-write into the sandbox.
- One local open-source instance shared by a team with no authentication.
- The GitHub app installed on every repository in the organization.
Products in this piece
Sources
- Official documentation
- 16
- Public source
- 3
- OpenHands docs: FAQs
- OpenHands on GitHub: Agent Canvas (MIT)
- OpenHands docs: Sandbox overview
- OpenHands docs: Docker sandbox
- OpenHands docs: Process sandbox
- OpenHands docs: Agent Canvas architecture
- OpenHands docs: Agent Canvas backends
- OpenHands docs: Secrets management
- OpenHands docs: GitHub integration
- OpenHands docs: Organizations
- OpenHands docs: SDK security and action confirmation
- OpenHands docs: Hooks
- OpenHands docs: OpenHands Enterprise
- OpenHands docs: Enterprise vs. open source
- OpenHands docs: Enterprise architecture
- wunderwuzzi, Embrace The Red: OpenHands and the lethal trifecta (Aug 9, 2025)
- wunderwuzzi, Embrace The Red: OpenHands remote code execution through prompt injection (Aug 10, 2025)
- morgaesis, GitHub issue #11206: locally mounted folders are chowned to root (Oct 1, 2025)
- OpenHands privacy policy (effective September 3, 2025)