Board: the agent with a persistent computer

The goal is to show how an agent can keep a real computer between runs, sleep for free, wake when a request arrives, roll back a bad step, and call outside services without ever holding the password.

This page is drawn from https://fly.io/docs/sprites/concepts/lifecycle/, https://fly.io/docs/sprites/concepts/checkpoints/, https://fly.io/docs/sprites/concepts/connectors/, https://fly.io/docs/sprites/concepts/networking/, https://fly.io/docs/sprites/keeping-sprites-running/, https://fly.io/docs/sprites/integrations/agent-plugins/ and the live page https://fly.io/sprites/ (fetched via https://sprites.dev).

Whiteboard outcome

When you’re done, the board shows a Sprite with an agent inside, a disk that survives sleep, a timeline of checkpoints, a wake-on-HTTPS URL, an egress allowlist, and a gateway that holds the provider credential outside the Sprite.

Before you draw: three questions

1. Which agent (Claude Code, Codex, your own loop), and which model provider?
2. Which outside systems does it touch (GitHub, an internal API, a model router)?
3. Does it need to be always on, or is it fine to sleep between requests?

Draw it in 8 steps

1. In the middle, draw a large box: Sprite: agent-1 (8 vCPU, 100 GB). Say: “One Sprite per agent or per session. It’s a hardware-isolated Linux VM, billed by the second and free when idle” (https://fly.io/docs/sprites/index/, https://fly.io/docs/sprites/concepts/lifecycle/).
2. Inside, draw claude / codex / gemini and a disk labeled “ext4”. Say: “The agent CLIs come preinstalled. The disk is real ext4, backed by object storage” (https://fly.io/docs/sprites/working-with-sprites/, https://fly.io/docs/sprites/concepts/lifecycle/).
3. Draw a timeline under the box: v0, v1, v2, with a curved arrow back from v2 to v1. Say: “Checkpoint before a risky step, restore if it breaks. It captures the filesystem, not running processes” (https://fly.io/docs/sprites/concepts/checkpoints/).
4. Draw three states on the left: running, warm, cold. Say: “Idle about 30 seconds and it goes warm: frozen, not billed, back in 100-500ms. Later it goes cold: 1-2s to wake, processes restart fresh” (https://fly.io/docs/sprites/concepts/lifecycle/).
5. On the top, draw a URL name-orgid.sprites.app with an arrow into the box. Say: “An HTTPS request wakes it. Private to your org by default” (https://fly.io/docs/sprites/concepts/networking/). Ask: “Is the server a Service, so it’s up when the request lands?” (https://fly.io/docs/sprites/concepts/services/).
6. On the right, draw a gateway labeled “Connectors” with clouds GitHub, OpenRouter, your API. Draw a locked safe above it. Say: “The credential is stored in your org, not in the Sprite. The Sprite calls the gateway URL” (https://fly.io/docs/sprites/concepts/connectors/).
7. Draw a red arrow from the box to the safe and cross it out. Say: “The Sprite never holds the provider token, and a connector with no policy refuses every Sprite” (https://fly.io/docs/sprites/concepts/connectors/).
8. Draw a wall on the far right labeled “egress allowlist”. Say: “Tighten outbound to a DNS allowlist, set from outside. Blocked domains get REFUSED” (https://fly.io/docs/sprites/concepts/networking/).

Write the rule at the bottom: Disk persists, memory does not; credentials live at the gateway, not on the Sprite. (https://fly.io/docs/sprites/concepts/lifecycle/, https://fly.io/docs/sprites/concepts/connectors/)

flowchart LR
  U[Caller or you] -->|HTTPS request wakes| SP
  subgraph SP[Sprite agent-1]
    AG[Agent CLI]
    DK[(ext4 disk)]
  end
  SP --- CK[Checkpoints v0 v1 v2]
  SP -->|gateway URL| GW[Sprites gateway]
  KS[(Credential in org)] -.held here.-> GW
  GW --> GH[GitHub]
  GW --> OR[OpenRouter]
  SP -.x|egress allowlist| NET[Open internet]

The script for the commands

sprite create agent-1
sprite exec -s agent-1 -- git clone https://github.com/owner/repo
sprite checkpoint create --comment "clean clone"     # run inside: sprite-env checkpoints create
sprite config update --url-auth sprite               # URL stays org-only
sprite restore v1                                    # roll back
sprite destroy -s agent-1                            # irreversible

Commands are from https://fly.io/docs/sprites/cli/commands/ and https://fly.io/docs/sprites/concepts/checkpoints/. The egress policy and connector setup are done from outside the Sprite, in the dashboard or the API (https://fly.io/docs/sprites/concepts/networking/, https://fly.io/docs/sprites/concepts/connectors/).

What they’ll ask