Image: devvm
Why it mattersA coding agent with a bad day can read any file your account can read. devvm walls it off at the project folder and the hosts you allow.
The agent runs in a sandbox, not on your Mac. That is the one-line pitch of devvm. devvm is an open-source tool. It gives every project folder its own Linux VM, and starts the coding agent inside it. The devvmhq organization created the repository on 6 November. It reached 372 stars on GitHub by 8 November. The code is in Go. The licence is MIT.
What devvm does
You run devvm inside a project folder on your Mac or Linux box. It reads the folder and picks the toolchains the files call for. Then it builds a VM with those tools, your git name and email, and the coding agent of your choice. The first run walks you through defaults, such as the size and the agents new VMs get. Every run after that opens a shell in the VM. Its prompt starts with (devvm). You type claude, codex or opencode there, and the agent runs in the VM.
Supported toolchains are node, python, rust, go and dotnet. Supported agents are Claude Code, Codex, opencode and Pi. devvm imports your agent settings, skills and MCP servers read-only. The agent then behaves the way you set it up on your machine. Your conversation history stays on your machine.
What it keeps out
A VM mounts only the project folder, at the same path as on your Mac. Nothing else in your home folder goes into it. ~/.ssh, ~/.aws and your other projects stay out of reach. On macOS, devvm locks the project's .git hooks and config. The VM cannot change what git runs on your machine. With a --clone flag, the VM works on its own clone of the repo. The project folder itself stays unmounted.
Every new VM starts on the allowlist network tier by default. On that tier the VM reaches only the hosts on a list you keep. It reaches them through a proxy that runs on your Mac. The proxy also adds your tokens to outbound requests. The real credentials never leave your machine: the VM holds placeholders. Three other tiers run from none to open.
Traction and limits
devvm runs on Apple silicon Macs and on Linux. It supports arm64 and x86_64. On macOS it uses Apple's Virtualization framework. On Linux it uses QEMU. The underlying runner is Lima. devvm says the base image builds once. Every later VM is a copy of it, up in seconds. Each version of a toolchain is shared read-only across every VM.
The project's own docs list what the sandbox cannot do. The .git lock is macOS-only. SSH agent forwarding is off by default. Some attacks can still reach the project folder, because the VM has to be able to write to it. A short Staying safe page spells each of these out.
A coding agent that can run commands is one bad prompt from rm -rf ~. The whole agent world is working on this in its own way. A per-project VM with a tight network allowlist is one of the cleaner answers.
Source
devvmhq/devvm on GitHub. The project site is devvm.dev.
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.