{"slug": "brig-run-coding-agents-in-a-microvm-sandbox", "title": "Brig: Run coding agents in a MicroVM sandbox", "summary": "Brig, a tool from the brig-sh project, runs coding agents inside a microVM sandbox on the user's own machine, starting a session with the command `brig run claude ~/code/demo`. The sandbox boots with no credentials, mounts a named project read-write at `/work/<name>`, and excludes all other host directories, the keychain, and the SSH agent, with egress policy enforced only on hull's `hvi` backend. Brig requires macOS 15 or newer on Apple silicon Macs, or macOS 14 with `BRIG_HYPERVISOR=vz`, and supports Linux x86-64 or arm64 with `nerdctl`, containerd and the `urunc` shim; Intel Macs are not supported.", "body_md": "**Brig runs a coding agent inside a microVM on your own machine.**\n\nAn agent working unattended can only damage what you handed it. Point it at one project, and a bad edit or a bad command reaches no further than that project. When you are done, throw the sandbox away and start clean.\n\nOne command starts a sandbox and runs the agent in it:\n\n```\nbrig run claude ~/code/demo\n```\n\nA session is `<agent>` or `<agent>@<label>`, the ref every command takes.\n`claude` and `claude@refactor` are two independent sessions of the same\nagent, each with its own sandbox. The guest home is the host directory\nholding a session's settings and history. `claude` resolves to the\n`claude-code` agent, so its guest home is `~/brig/claude-code`, and\n`claude@refactor`'s is the sibling `~/brig/claude-code-refactor`, not a\ndirectory inside it.\n\nName a project on the run line, and Brig mounts it read-write at\n`/work/<name>`, where the agent starts. Credentials reach the guest only\nwhen you deliver them: the sandbox boots with none, and the agent asks you\nto log in. What the guest does not get: every other host directory, your\nkeychain, and your SSH agent. [docs/sessions.md](https://github.com/brig-sh/brig/blob/main/docs/sessions.md) is the\nfull model.\n\n| Host | Supported | \n|---|---|\n| Mac, Apple silicon, macOS 15 or newer | Yes | \n| Mac, Apple silicon, macOS 14 | Yes, with `BRIG_HYPERVISOR=vz` | \n| Intel Mac | No | \n| Linux, x86-64 or arm64 | Yes, with `nerdctl` , containerd and the`urunc` shim | \n\nmacOS 15 is the floor: six of the eight built-in profiles need the `hvi`\nbackend. See [docs/install.md#platform-support](https://github.com/brig-sh/brig/blob/main/docs/install.md#platform-support)\nfor the rest.\n\n```\nbrew tap brig-sh/brig\nbrew trust brig-sh/brig\nbrew install --cask brig\n```\n\nThe cask brings [hull](https://github.com/brig-sh/hull) and `cosign` with\nit. For `install.sh`, Linux, or a source build, see [docs/install.md](https://github.com/brig-sh/brig/blob/main/docs/install.md).\n\n```\nbrig doctor\n```\n\nEach line is a check. A `!!` line prints its fix beside it.\n\n```\nmkdir -p ~/code/demo\nbrig run claude ~/code/demo\n```\n\nBrig prints `brig: image and boot assets verified`, Claude Code asks you to log\nin inside the sandbox, and `pwd` inside the agent prints `/work/demo`. The\nfirst run pulls the guest image and the boot assets, so it is slow.\n[docs/authentication.md](https://github.com/brig-sh/brig/blob/main/docs/authentication.md) covers the login and how\nto carry one in from the host.\n\n```\nbrig stop claude    # stop the sandbox, keep its name\nbrig rm claude      # stop it and remove it\n```\n\nNeither touches `~/brig/claude-code` or `~/code/demo`.\n[docs/quickstart.md](https://github.com/brig-sh/brig/blob/main/docs/quickstart.md) walks through all of this, explained.\n\nThe project mount is read-write, and those are your real files: the agent\ncan change anything under it. On the default `shared` network the agent\nreaches the internet, so anything it can read it can also send. Brig\nenforces egress policy only on hull's `hvi` backend, and refuses a\npolicy-bound run on any other backend rather than run it unenforced. Image\nverification defaults to `warn`, which reports an unverifiable image and\nboots it anyway. Set `BRIG_VERIFY=require` to refuse one instead.\n[docs/security.md](https://github.com/brig-sh/brig/blob/main/docs/security.md) has the full picture.\n\n| If you want to | Read | \n|---|---|\n| Install Brig on any supported host | [docs/install.md](https://github.com/brig-sh/brig/blob/main/docs/install.md) | \n| Get a first agent running, step by step | [docs/quickstart.md](https://github.com/brig-sh/brig/blob/main/docs/quickstart.md) | \n| Understand homes, projects and sessions | [docs/sessions.md](https://github.com/brig-sh/brig/blob/main/docs/sessions.md) | \n| Log an agent in, or give it Git access | [docs/authentication.md](https://github.com/brig-sh/brig/blob/main/docs/authentication.md) ,[docs/secrets.md](https://github.com/brig-sh/brig/blob/main/docs/secrets.md) | \n| Look up a command, a flag or a variable | [docs/cli.md](https://github.com/brig-sh/brig/blob/main/docs/cli.md) | \n| Run your own agent or your own image | [docs/profiles.md](https://github.com/brig-sh/brig/blob/main/docs/profiles.md) ,[docs/guest-image.md](https://github.com/brig-sh/brig/blob/main/docs/guest-image.md) | \n| Restrict what the guest can reach | [docs/policies.md](https://github.com/brig-sh/brig/blob/main/docs/policies.md) | \n| Understand the isolation, and its limits | [docs/security.md](https://github.com/brig-sh/brig/blob/main/docs/security.md) | \n| Know what Brig counts, and turn it off | [docs/telemetry.md](https://github.com/brig-sh/brig/blob/main/docs/telemetry.md) | \n| Fix something that went wrong | [docs/troubleshooting.md](https://github.com/brig-sh/brig/blob/main/docs/troubleshooting.md) | \n| Move off a retired command spelling | [docs/migration.md](https://github.com/brig-sh/brig/blob/main/docs/migration.md) | \n| Know what is stable and what is not | [docs/stability.md](https://github.com/brig-sh/brig/blob/main/docs/stability.md) | \n\nThe full index is [docs/README.md](https://github.com/brig-sh/brig/blob/main/docs/README.md).\n\nBrig is a prerelease, in the `0.1.0-rc` series. `brig version` prints yours,\nand [docs/stability.md](https://github.com/brig-sh/brig/blob/main/docs/stability.md) says what you can script against\ntoday. [docs/support.md](https://github.com/brig-sh/brig/blob/main/docs/support.md) says where to ask a question or\nfile a bug, and [SECURITY.md](https://github.com/brig-sh/brig/blob/main/SECURITY.md) is where to report a\nvulnerability instead of a public issue. [CONTRIBUTING.md](https://github.com/brig-sh/brig/blob/main/CONTRIBUTING.md)\ncovers the build, the tests and the review norms, and\n[AI_POLICY.md](https://github.com/brig-sh/brig/blob/main/AI_POLICY.md) says how AI-assisted contributions are\nhandled. Brig ships under the Apache License 2.0. See [LICENSE](https://github.com/brig-sh/brig/blob/main/LICENSE).\n\nBrig itself counts nothing. On macOS the hull runtime it drives counts a\nfew events, and on Linux nothing is sent. `brig telemetry status` shows the\ncurrent setting, and `brig telemetry off` turns it off.\n[docs/telemetry.md](https://github.com/brig-sh/brig/blob/main/docs/telemetry.md) has the field-by-field detail.", "url": "https://wpnews.pro/news/brig-run-coding-agents-in-a-microvm-sandbox", "canonical_source": "https://github.com/brig-sh/brig", "published_at": "2026-09-15 07:46:04+00:00", "updated_at": "2026-09-15 08:03:58.460651+00:00", "lang": "en", "topics": ["ai-agents", "developer-tools", "ai-tools"], "entities": ["Brig", "brig-sh", "Claude Code", "hull", "cosign", "nerdctl", "containerd", "urunc"], "alternates": {"html": "https://wpnews.pro/news/brig-run-coding-agents-in-a-microvm-sandbox", "markdown": "https://wpnews.pro/news/brig-run-coding-agents-in-a-microvm-sandbox.md", "text": "https://wpnews.pro/news/brig-run-coding-agents-in-a-microvm-sandbox.txt", "jsonld": "https://wpnews.pro/news/brig-run-coding-agents-in-a-microvm-sandbox.jsonld"}}