Headmin! vs Sandbox Relay

Headmin is a native admin console for Headscale, the open-source, self-hosted control server for Tailscale-based networks. Point it at your own server and manage your entire tailnet from your phone — no dashboard tab required. CONNECT TO YOUR OWN SERVER Enter your Headscale URL and API key once. Your credentials are validated and then stored securely on-device, in your phone's Keychain or Keystore — never on our servers, because we don't have any. Headmin talks directly to your Headscale instance. USERS List, create, rename and delete users in seconds. NODES See every device on your network at a glance: online status, IP addresses and tags. Rename a node, move it to a different user, expire its key, or remove it entirely. Generate pre-auth keys with custom expiry, reusable or single-use, tagged for your ACLs. ROUTES View every subnet route and exit node your devices advertise, and approve or disable them individually. ACL POLICIES Edit rules, groups, tag owners and hosts through a visual editor, or drop into a raw HuJSON view for full control. BUILT FOR SELF-HOSTERS Headmin has no backend of its own and no account system — it's a thin, secure client for the server you already run. Your data stays between your phone and your infrastructure. Requires an existing Headscale server and an API key (generate one with `headscale apikeys create`).

For developers who run Claude Code or Codex in Docker Sandbox, Sandbox Relay is the phone client for driving that agent. It is a companion, not a standalone app: it needs a broker you run, with an agent connected behind it. Kick off a task from the train, check on a long-running job from the couch, or steer the agent while you are away from your desk. Docker Sandbox runs each agent in its own isolated micro VM. A small broker you self-host sits in the middle: you send work from your phone, the broker passes it to the agent, and the streamed reply comes back. Your infrastructure, your agent. The app is just the remote. New to this setup? The app's support page explains how it works and what you need to run it. WHAT YOU CAN DO - Connect to your broker with a URL and a bearer token. Connections use HTTPS, with plain HTTP allowed only for local-network addresses. - See every connected agent at a glance, with live online/offline status. - Send the agent work and watch its reply stream in token by token. Stop a turn mid-stream, or start a fresh thread whenever you want. - When an agent goes offline, its thread stays readable as history. - See per-turn input and output token counts when the broker reports them. - Save reusable prompts as local notes, organised by hierarchical tags like #work/project/feature. Drill down by tag, copy a note straight into a thread, or link a note to the thread it came from. Notes live on your device only; they never touch the broker. WHAT YOU NEED - A broker you run, reachable from your phone (over your local network, or remotely through a tunnel or private network you control). - A coding agent, Claude Code or Codex, running in Docker Sandbox and connected to that broker. PRIVACY Sandbox Relay talks only to the broker you configure. Your access token is stored securely on your device and sent only to that broker, to authenticate you; it never goes to the developer or any third party. Your notes stay on your device and are never sent anywhere. No third-party analytics, no account to create. Note that the app streams whatever your agent outputs, verbatim.