# Brig: Run coding agents in a MicroVM sandbox

> Source: <https://github.com/brig-sh/brig>
> Published: 2026-09-15 07:46:04+00:00

**Brig runs a coding agent inside a microVM on your own machine.**

An agent working unattended can only damage what you handed it. Point it at one project, and a bad edit or a bad command reaches no further than that project. When you are done, throw the sandbox away and start clean.

One command starts a sandbox and runs the agent in it:

```
brig run claude ~/code/demo
```

A session is `<agent>` or `<agent>@<label>`, the ref every command takes.
`claude` and `claude@refactor` are two independent sessions of the same
agent, each with its own sandbox. The guest home is the host directory
holding a session's settings and history. `claude` resolves to the
`claude-code` agent, so its guest home is `~/brig/claude-code`, and
`claude@refactor`'s is the sibling `~/brig/claude-code-refactor`, not a
directory inside it.

Name a project on the run line, and Brig mounts it read-write at
`/work/<name>`, where the agent starts. Credentials reach the guest only
when you deliver them: the sandbox boots with none, and the agent asks you
to log in. What the guest does not get: every other host directory, your
keychain, and your SSH agent. [docs/sessions.md](https://github.com/brig-sh/brig/blob/main/docs/sessions.md) is the
full model.

| Host | Supported | 
|---|---|
| Mac, Apple silicon, macOS 15 or newer | Yes | 
| Mac, Apple silicon, macOS 14 | Yes, with `BRIG_HYPERVISOR=vz` | 
| Intel Mac | No | 
| Linux, x86-64 or arm64 | Yes, with `nerdctl` , containerd and the`urunc` shim | 

macOS 15 is the floor: six of the eight built-in profiles need the `hvi`
backend. See [docs/install.md#platform-support](https://github.com/brig-sh/brig/blob/main/docs/install.md#platform-support)
for the rest.

```
brew tap brig-sh/brig
brew trust brig-sh/brig
brew install --cask brig
```

The cask brings [hull](https://github.com/brig-sh/hull) and `cosign` with
it. For `install.sh`, Linux, or a source build, see [docs/install.md](https://github.com/brig-sh/brig/blob/main/docs/install.md).

```
brig doctor
```

Each line is a check. A `!!` line prints its fix beside it.

```
mkdir -p ~/code/demo
brig run claude ~/code/demo
```

Brig prints `brig: image and boot assets verified`, Claude Code asks you to log
in inside the sandbox, and `pwd` inside the agent prints `/work/demo`. The
first run pulls the guest image and the boot assets, so it is slow.
[docs/authentication.md](https://github.com/brig-sh/brig/blob/main/docs/authentication.md) covers the login and how
to carry one in from the host.

```
brig stop claude    # stop the sandbox, keep its name
brig rm claude      # stop it and remove it
```

Neither touches `~/brig/claude-code` or `~/code/demo`.
[docs/quickstart.md](https://github.com/brig-sh/brig/blob/main/docs/quickstart.md) walks through all of this, explained.

The project mount is read-write, and those are your real files: the agent
can change anything under it. On the default `shared` network the agent
reaches the internet, so anything it can read it can also send. Brig
enforces egress policy only on hull's `hvi` backend, and refuses a
policy-bound run on any other backend rather than run it unenforced. Image
verification defaults to `warn`, which reports an unverifiable image and
boots it anyway. Set `BRIG_VERIFY=require` to refuse one instead.
[docs/security.md](https://github.com/brig-sh/brig/blob/main/docs/security.md) has the full picture.

| If you want to | Read | 
|---|---|
| Install Brig on any supported host | [docs/install.md](https://github.com/brig-sh/brig/blob/main/docs/install.md) | 
| Get a first agent running, step by step | [docs/quickstart.md](https://github.com/brig-sh/brig/blob/main/docs/quickstart.md) | 
| Understand homes, projects and sessions | [docs/sessions.md](https://github.com/brig-sh/brig/blob/main/docs/sessions.md) | 
| Log an agent in, or give it Git access | [docs/authentication.md](https://github.com/brig-sh/brig/blob/main/docs/authentication.md) ,[docs/secrets.md](https://github.com/brig-sh/brig/blob/main/docs/secrets.md) | 
| Look up a command, a flag or a variable | [docs/cli.md](https://github.com/brig-sh/brig/blob/main/docs/cli.md) | 
| Run your own agent or your own image | [docs/profiles.md](https://github.com/brig-sh/brig/blob/main/docs/profiles.md) ,[docs/guest-image.md](https://github.com/brig-sh/brig/blob/main/docs/guest-image.md) | 
| Restrict what the guest can reach | [docs/policies.md](https://github.com/brig-sh/brig/blob/main/docs/policies.md) | 
| Understand the isolation, and its limits | [docs/security.md](https://github.com/brig-sh/brig/blob/main/docs/security.md) | 
| Know what Brig counts, and turn it off | [docs/telemetry.md](https://github.com/brig-sh/brig/blob/main/docs/telemetry.md) | 
| Fix something that went wrong | [docs/troubleshooting.md](https://github.com/brig-sh/brig/blob/main/docs/troubleshooting.md) | 
| Move off a retired command spelling | [docs/migration.md](https://github.com/brig-sh/brig/blob/main/docs/migration.md) | 
| Know what is stable and what is not | [docs/stability.md](https://github.com/brig-sh/brig/blob/main/docs/stability.md) | 

The full index is [docs/README.md](https://github.com/brig-sh/brig/blob/main/docs/README.md).

Brig is a prerelease, in the `0.1.0-rc` series. `brig version` prints yours,
and [docs/stability.md](https://github.com/brig-sh/brig/blob/main/docs/stability.md) says what you can script against
today. [docs/support.md](https://github.com/brig-sh/brig/blob/main/docs/support.md) says where to ask a question or
file a bug, and [SECURITY.md](https://github.com/brig-sh/brig/blob/main/SECURITY.md) is where to report a
vulnerability instead of a public issue. [CONTRIBUTING.md](https://github.com/brig-sh/brig/blob/main/CONTRIBUTING.md)
covers the build, the tests and the review norms, and
[AI_POLICY.md](https://github.com/brig-sh/brig/blob/main/AI_POLICY.md) says how AI-assisted contributions are
handled. Brig ships under the Apache License 2.0. See [LICENSE](https://github.com/brig-sh/brig/blob/main/LICENSE).

Brig itself counts nothing. On macOS the hull runtime it drives counts a
few events, and on Linux nothing is sent. `brig telemetry status` shows the
current setting, and `brig telemetry off` turns it off.
[docs/telemetry.md](https://github.com/brig-sh/brig/blob/main/docs/telemetry.md) has the field-by-field detail.