Developer Platforms

Coder Agent Relay Self-Hosts Execution; Reasoning Stays in the Cloud

By Kaleido Field Staff · September 5, 2026

Citation-ready: Coder introduced Agent Relay in private preview on September 2, 2026, to run a cloud coding agent's execution inside self-hosted Coder workspaces while the provider retains the cloud reasoning loop and inference path.

What happened and why it matters

Commands, files, credentials, and workspace execution can remain in the customer's environment, while the provider still owns the agent loop and routes inference through its cloud; teams must trace every payload crossing that connection.

Official Coder architecture and limitation disclosure

Primary reference: Coder: Introducing Agent Relay. Kaleido Field checked the event date and the article's attributed facts against this source.

Self-hosted is not a binary label

Source files and commands may stay in a Coder workspace while task instructions, summaries, tool outputs, diffs, or other context cross the secure connection to the provider that plans the work. The public post does not enumerate every payload.

Build a data-flow map for prompt, repository content, retrieved context, terminal output, secrets, tool results, diff, telemetry, logs, model input, model output, and deletion, then verify it against contracts and observed network traffic.

Identity makes an audit possible, not correct

Agent Relay resolves incoming work against the organization's identity provider so activity can be attributed to the requesting person. That helps scope access and investigation when the mapping survives every retry and background step.

Test disabled users, changed group membership, service accounts, shared sessions, retries, delegated work, long-running tasks, workspace reuse, failed cleanup, and whether commit, command, file, and network logs carry the same durable request identity.

Private preview keeps the operational claim narrow

Coder says the architecture is available with design partners and publishes documentation for teams evaluating broader access. Preview users should work from the contract and controls they can actually inspect.

A production decision still needs versioned documentation, support and incident terms, upgrade behavior, availability, data processing and residency commitments, penetration testing, code review gates, and a harmless denied-path exercise under the real workspace template.

Evidence boundary

Official architecture facts: private-preview state; Cursor as first integration partner; external provider request; prebuilt or newly launched Coder workspace; provider daemon connected to its external service; Coder Agent Firewall, RBAC, and audit logging; and request-to-human identity mapping. Explicit limitation: the provider still runs the reasoning loop and LLM inference calls still route through its infrastructure rather than Coder's AI Gateway. Coder claims: code and secrets can stay in the customer's VPC under described policy and workspace controls, plus company-reported maturity and customer audit metrics. Not established: complete payload inventory across the provider connection, prompt and metadata residency, provider retention, independent isolation or exfiltration test, default deny behavior, policy bypass resistance, model quality, code correctness, availability beyond design partners, or production compliance for a specific organization.