{"slug": "dev-sandbox-one-bash-script-to-isolate-ai-coding-agents-with-podman", "title": "Dev-sandbox – One bash script to isolate AI coding agents with Podman", "summary": "Developer kosmrljt released dev-sandbox, a single bash script that isolates AI coding agents such as Claude Code and Google's Antigravity in Podman containers, optionally using krun microVMs for stronger isolation. The tool, tested on Fedora 44, mounts only the current project directory, hides host files like SSH keys and AWS credentials, and offers four profiles including a VNC GUI option. It addresses risks like prompt injection and malicious packages, though it does not prevent writes to .git/hooks or persistent volumes.", "body_md": "**Run AI coding agents in isolated Podman containers, optionally with krun microVMs.**\n\nFor Linux distributions with Podman support. Developed and tested on Fedora 44.\n\nOne self-contained bash script. No dependencies beyond Podman. Configure profiles, build, run — everything in a single file.\n\nAI coding agents need shell access and run arbitrary code. Without isolation:\n\n- An agent can read\n`~/.ssh/`\n\n,`~/.aws/`\n\n, browser cookies, API keys - A malicious pip package in\n`setup.py`\n\ncan exfiltrate data silently - Prompt injection in a file can instruct the agent to run destructive commands\n- You have no visibility into what network connections the agent makes\n\ndev-sandbox runs each agent in its own isolated environment with only the current project directory visible.\n\nWhat this does **not** prevent: an agent can write to `.git/hooks`\n\nand persistent volumes, which execute on the next run. See [docs/SECURITY.md](/kosmrljt/dev-sandbox/blob/main/docs/SECURITY.md).\n\n```\n# Install (Fedora/RHEL)\nsudo dnf install podman crun-krun\n\n# Install (Ubuntu/Debian)\nsudo apt install podman\n\n# Download\ncurl -o ~/.local/bin/dev-sandbox https://raw.githubusercontent.com/kosmrljt/dev-sandbox/main/dev-sandbox.sh\nchmod +x ~/.local/bin/dev-sandbox\n\n# Run from your project directory (only this directory is visible inside the sandbox)\ncd ~/my-project\ndev-sandbox                      # with krun (Fedora)\ndev-sandbox --no-krun            # without krun (Ubuntu or any Linux)\n```\n\nThe first run builds images (~1.6 GB, several minutes). Subsequent runs start in seconds. The default profile is configured for Claude Code — edit the script to change.\n\nOnce inside, you are in an isolated container:\n\n```\n[claude] /app/my-project--[HASH]$          ← colored prompt shows profile name\n```\n\n- You are user\n`dev`\n\n, not your host user - Only your project directory is visible (mounted at\n`/app/...`\n\n) - Your home directory, SSH keys, and other host files are not accessible\n- pip packages, credentials, and config persist between sessions in named volumes\n- Type\n`exit`\n\nto leave\n\nFour built-in profiles with color-coded prompts. Each is isolated — separate volumes, credentials, and settings.\n\n| Profile | Agent | Color | Description |\n|---|---|---|---|\n`claude` (default) |\nClaude Code | Green | |\n`research` |\nNone (template) | Red | Add your own untrusted agents |\n`agy` |\nAntigravity | Yellow | Google AI agent |\n`vncgui` |\nGUI apps | Purple | VNC + XFCE desktop |\n\n```\ndev-sandbox                         # claude (default)\nclaude                              # start agent inside container\n\ndev-sandbox -p agy                  # antigravity\nagy                                 # start agent inside container\n\ndev-sandbox -p research             # empty template, add your agents\n\ndev-sandbox -p vncgui               # XFCE desktop\n# On host: connect with VNC viewer (e.g. TigerVNC)\nvncviewer localhost:5901            # password: sandbox\n```\n\nShow resolved settings for any profile:\n\n```\ndev-sandbox info                    # default profile\ndev-sandbox -p research info        # specific profile\n```\n\n| Need | Runtime |\n|---|---|\n| VM isolation + firewall | krun, SSH off (auto-passt) |\n| VM isolation + SSH terminal | krun (auto-TSI) or `--tsi` |\n| VS Code Remote SSH | `--no-krun` |\n| Firewall + SSH | `--no-krun` |\n\nkrun runs its own Linux kernel inside a microVM — a different isolation boundary than container namespaces. Standard container shares the host kernel but has full support for SSH tunneling and firewall.\n\nDefault is krun. Architecture details: [docs/ARCHITECTURE.md](/kosmrljt/dev-sandbox/blob/main/docs/ARCHITECTURE.md).\n\n``` php\ngraph LR\n    Script[dev-sandbox.sh] -->|build| Image[Profile Image]\n    Script -->|run| Container\n    Container --- Volumes[Named Volumes]\n    Project[Project Dir] -->|bind mount| Container\n# All traffic through SOCKS proxy on host\ndev-sandbox --proxy 1080\n\n# No outbound traffic\ndev-sandbox --net locked\n\n# SSH for VS Code (requires --no-krun)\ndev-sandbox --no-krun --ssh-port 2228 --ssh-key ~/.ssh/id_ed25519.pub\n\n# Pass env from host (never in script or CLI history)\ndev-sandbox --env ANTHROPIC_API_KEY\n\n# Resource limits\ndev-sandbox --ram 8192 --cpus 8\n```\n\nAll flags: `dev-sandbox help`\n\nDefaults apply to all profiles. Each profile only overrides what differs:\n\n```\nDEFAULT_USE_KRUN=true\nDEFAULT_SSH_PORT=0\nDEFAULT_COLOR=\"0\"              # 31=red, 32=green, 33=yellow\n\nPROFILE_claude_COLOR=\"32\"      # Green — trusted\n\nPROFILE_research_COLOR=\"31\"    # Red — untrusted\nPROFILE_research_SSH_PORT=0    # No SSH → passt → firewall works\n\nALL_PROFILES=(claude research agy vncgui)\n```\n\nAdding a new profile:\n\n```\nPROFILE_test_DESCRIPTION=\"My test sandbox\"\nPROFILE_test_COLOR=\"33\"\nALL_PROFILES=(claude research agy vncgui test)\n```\n\nSettings resolve: CLI flag > Profile > Environment > Default.\n\nFull configuration reference: [docs/CONFIGURATION.md](/kosmrljt/dev-sandbox/blob/main/docs/CONFIGURATION.md).\n\n**Podman 4.x+**—`sudo dnf install podman`\n\n(Fedora/RHEL),`sudo apt install podman`\n\n(Ubuntu/Debian)**crun-krun**— optional, for krun microVM mode. Without it, use`--no-krun`\n\nfor standard containers**passt**— usually installed with crun-krun\n\nOptional: **gocryptfs** for encrypted directories, **btrfs** for quotas and snapshots.\n\n**krun + SSH port mapping**: Does not work with passt networking. The script uses passt when firewall is active or SSH is off, TSI otherwise.** TSI connection bottleneck**: TSI stalls under many concurrent connections (e.g. loading a portal with many resources). This is why passt is preferred. Use`--tsi`\n\nonly for testing.**No**: Use SSH or tmux for additional terminals.`podman exec`\n\nwith krun: Bind-mounted project directory is writable. An agent can plant hooks that execute on the host. Review changes after sessions.`.git/hooks`\n\n**tty warning**:`tty: ttyname error`\n\non krun startup is cosmetic.\n\n[urllight](https://github.com/kosmrljt/urllight) — SOCKS5 proxy with live terminal dashboard. Route sandbox traffic through it to see every connection and DNS query.\n\nMIT © Tomaž Košmrlj\n\nInspired by the [Fedora Magazine article on sandboxing AI agents with microVMs](https://fedoramagazine.org/sandbox-ai-coding-agents-with-microvms-on-fedora-linux/). Built through iterative pair programming with Claude (Anthropic).", "url": "https://wpnews.pro/news/dev-sandbox-one-bash-script-to-isolate-ai-coding-agents-with-podman", "canonical_source": "https://github.com/kosmrljt/dev-sandbox", "published_at": "2026-09-01 20:16:11+00:00", "updated_at": "2026-09-01 20:22:32.144948+00:00", "lang": "en", "topics": ["ai-tools", "ai-safety", "developer-tools"], "entities": ["kosmrljt", "Podman", "Claude Code", "Antigravity", "Fedora 44", "krun"], "alternates": {"html": "https://wpnews.pro/news/dev-sandbox-one-bash-script-to-isolate-ai-coding-agents-with-podman", "markdown": "https://wpnews.pro/news/dev-sandbox-one-bash-script-to-isolate-ai-coding-agents-with-podman.md", "text": "https://wpnews.pro/news/dev-sandbox-one-bash-script-to-isolate-ai-coding-agents-with-podman.txt", "jsonld": "https://wpnews.pro/news/dev-sandbox-one-bash-script-to-isolate-ai-coding-agents-with-podman.jsonld"}}