devvm: Sandbox VM Per Project for Developers and Coding Agents

devvm is an open-source tool that automatically creates an isolated sandbox VM for each project, complete with the required toolchain. A single command launches the VM ready for developers or coding agents (Claude Code, Codex, or opencode). Sensible defaults eliminate configuration overhead.

The tool isolates developer security threats—supply chain attacks, leaked secrets, prompt injections, and rogue agents—within the sandbox. By default, VMs use an allowlist network tier that restricts outbound traffic to approved hosts through a proxy on the host machine. On macOS, .git hooks and configuration are locked, preventing the VM from modifying host git settings. Authentication secrets like Claude Code tokens and Codex logins remain on the host; the VM receives only placeholders, with the proxy substituting real credentials into outbound requests.

devvm runs on macOS and Linux (arm64 and x86_64), using Lima with Apple’s Virtualization framework on macOS or QEMU on Linux. The tool supports custom layers, devcontainer.json integration, automatic port forwarding, and VS Code remote SSH. It’s released under the MIT license.