Brig: Run coding agents in a MicroVM sandbox

Brig, a tool from the brig-sh project, runs coding agents inside a microVM sandbox on the user's own machine, starting a session with the command `brig run claude ~/code/demo`. The sandbox boots with no credentials, mounts a named project read-write at `/work/<name>`, and excludes all other host directories, the keychain, and the SSH agent, with egress policy enforced only on hull's `hvi` backend. Brig requires macOS 15 or newer on Apple silicon Macs, or macOS 14 with `BRIG_HYPERVISOR=vz`, and supports Linux x86-64 or arm64 with `nerdctl`, containerd and the `urunc` shim; Intel Macs are not supported.

Brig runs a coding agent inside a microVM on your own machine. An agent working unattended can only damage what you handed it. Point it at one project, and a bad edit or a bad command reaches no further than that project. When you are done, throw the sandbox away and start clean. One command starts a sandbox and runs the agent in it: brig run claude ~/code/demo A session is <agent or <agent @<label , the ref every command takes. claude and claude@refactor are two independent sessions of the same agent, each with its own sandbox. The guest home is the host directory holding a session's settings and history. claude resolves to the claude-code agent, so its guest home is ~/brig/claude-code , and claude@refactor 's is the sibling ~/brig/claude-code-refactor , not a directory inside it. Name a project on the run line, and Brig mounts it read-write at /work/<name , where the agent starts. Credentials reach the guest only when you deliver them: the sandbox boots with none, and the agent asks you to log in. What the guest does not get: every other host directory, your keychain, and your SSH agent. docs/sessions.md https://github.com/brig-sh/brig/blob/main/docs/sessions.md is the full model. | Host | Supported | |---|---| | Mac, Apple silicon, macOS 15 or newer | Yes | | Mac, Apple silicon, macOS 14 | Yes, with BRIG HYPERVISOR=vz | | Intel Mac | No | | Linux, x86-64 or arm64 | Yes, with nerdctl , containerd and the urunc shim | macOS 15 is the floor: six of the eight built-in profiles need the hvi backend. See docs/install.md platform-support https://github.com/brig-sh/brig/blob/main/docs/install.md platform-support for the rest. brew tap brig-sh/brig brew trust brig-sh/brig brew install --cask brig The cask brings hull https://github.com/brig-sh/hull and cosign with it. For install.sh , Linux, or a source build, see docs/install.md https://github.com/brig-sh/brig/blob/main/docs/install.md . brig doctor Each line is a check. A line prints its fix beside it. mkdir -p ~/code/demo brig run claude ~/code/demo Brig prints brig: image and boot assets verified , Claude Code asks you to log in inside the sandbox, and pwd inside the agent prints /work/demo . The first run pulls the guest image and the boot assets, so it is slow. docs/authentication.md https://github.com/brig-sh/brig/blob/main/docs/authentication.md covers the login and how to carry one in from the host. brig stop claude stop the sandbox, keep its name brig rm claude stop it and remove it Neither touches ~/brig/claude-code or ~/code/demo . docs/quickstart.md https://github.com/brig-sh/brig/blob/main/docs/quickstart.md walks through all of this, explained. The project mount is read-write, and those are your real files: the agent can change anything under it. On the default shared network the agent reaches the internet, so anything it can read it can also send. Brig enforces egress policy only on hull's hvi backend, and refuses a policy-bound run on any other backend rather than run it unenforced. Image verification defaults to warn , which reports an unverifiable image and boots it anyway. Set BRIG VERIFY=require to refuse one instead. docs/security.md https://github.com/brig-sh/brig/blob/main/docs/security.md has the full picture. | If you want to | Read | |---|---| | Install Brig on any supported host | docs/install.md https://github.com/brig-sh/brig/blob/main/docs/install.md | | Get a first agent running, step by step | docs/quickstart.md https://github.com/brig-sh/brig/blob/main/docs/quickstart.md | | Understand homes, projects and sessions | docs/sessions.md https://github.com/brig-sh/brig/blob/main/docs/sessions.md | | Log an agent in, or give it Git access | docs/authentication.md https://github.com/brig-sh/brig/blob/main/docs/authentication.md , docs/secrets.md https://github.com/brig-sh/brig/blob/main/docs/secrets.md | | Look up a command, a flag or a variable | docs/cli.md https://github.com/brig-sh/brig/blob/main/docs/cli.md | | Run your own agent or your own image | docs/profiles.md https://github.com/brig-sh/brig/blob/main/docs/profiles.md , docs/guest-image.md https://github.com/brig-sh/brig/blob/main/docs/guest-image.md | | Restrict what the guest can reach | docs/policies.md https://github.com/brig-sh/brig/blob/main/docs/policies.md | | Understand the isolation, and its limits | docs/security.md https://github.com/brig-sh/brig/blob/main/docs/security.md | | Know what Brig counts, and turn it off | docs/telemetry.md https://github.com/brig-sh/brig/blob/main/docs/telemetry.md | | Fix something that went wrong | docs/troubleshooting.md https://github.com/brig-sh/brig/blob/main/docs/troubleshooting.md | | Move off a retired command spelling | docs/migration.md https://github.com/brig-sh/brig/blob/main/docs/migration.md | | Know what is stable and what is not | docs/stability.md https://github.com/brig-sh/brig/blob/main/docs/stability.md | The full index is docs/README.md https://github.com/brig-sh/brig/blob/main/docs/README.md . Brig is a prerelease, in the 0.1.0-rc series. brig version prints yours, and docs/stability.md https://github.com/brig-sh/brig/blob/main/docs/stability.md says what you can script against today. docs/support.md https://github.com/brig-sh/brig/blob/main/docs/support.md says where to ask a question or file a bug, and SECURITY.md https://github.com/brig-sh/brig/blob/main/SECURITY.md is where to report a vulnerability instead of a public issue. CONTRIBUTING.md https://github.com/brig-sh/brig/blob/main/CONTRIBUTING.md covers the build, the tests and the review norms, and AI POLICY.md https://github.com/brig-sh/brig/blob/main/AI POLICY.md says how AI-assisted contributions are handled. Brig ships under the Apache License 2.0. See LICENSE https://github.com/brig-sh/brig/blob/main/LICENSE . Brig itself counts nothing. On macOS the hull runtime it drives counts a few events, and on Linux nothing is sent. brig telemetry status shows the current setting, and brig telemetry off turns it off. docs/telemetry.md https://github.com/brig-sh/brig/blob/main/docs/telemetry.md has the field-by-field detail.