Devvm.dev: One VM for every project

Devvm, a free and open source tool from devvmhq, launches an isolated Linux VM per project that ships with the project's toolchain and can run coding agents such as Claude Code, Codex and opencode inside a sandbox. Devvm installs via Homebrew (brew install devvmhq/tap/devvm) alongside Lima, mounts the project folder at the same path, defaults new VMs to an allowlist network tier routed through a proxy on the host machine, and on macOS locks .git hooks and config so the VM cannot change what git runs locally. The tool is aimed at limiting the blast radius of supply chain attacks, leaked secrets, prompt injections and rogue agents, which devvm says developers face daily.

Free and open source https://github.com/devvmhq/devvm One VM for every project An isolated sandbox with your project’s toolchain, ready for you or a coding agent to start coding. Quick start Install devvm, and Lima with it brew trust --formula devvmhq/tap/devvm brew install devvmhq/tap/devvm The install script in the Linux tab also works on macOS, and Installing https://devvm.dev/docs/getting-started/install/ installing-devvm lists its options. 1. Go to your project Open a terminal and cd into any project folder. 2. Run devvm devvm shows what the new VM gets. Confirm to make it, or customize it. 3. Start your agent devvm opens a shell in the VM, whose prompt starts with devvm , so start your agent there. Claude Code needs your Claude login before its first start, which devvm agent login claude makes from the VM and keeps on your machine your first VM https://devvm.dev/docs/getting-started/first-vm/ claude-codes-login . The next time you run devvm in the folder, it opens the same VM, and devvm tools adds an agent to a VM you already have. What’s supported Toolchains devvm chooses the toolchains your project’s files call for, and you can choose more when you customize a new VM or name them with --tools toolchains https://devvm.dev/docs/using/toolchains/ . Coding agents Claude Code, Codex and opencode run in the VM. Choose one when you customize a new VM, or choose them for every new VM in devvm setup coding agents https://devvm.dev/docs/using/coding-agents/ . Layers devvm ships the docker , nix and desktop layers, which you choose when you customize a new VM, and devvm layer new creates your own custom layers you can apply to any of your VMs layers https://devvm.dev/docs/using/images/ layers . Why use devvm? - Developers face attacks every day, such as supply chain attacks https://en.wikipedia.org/wiki/Supply chain attack , leaked secrets, prompt injections https://en.wikipedia.org/wiki/Prompt injection and rogue agents. - A sandbox limits the blast radius https://en.wikipedia.org/wiki/Blast radius Uses in software of an attack to what’s inside it. - You know you should run your code and agents in a sandbox, but most tools need configuration and setup that’s hard to get right. - devvm ships with sensible defaults so you can start coding in a sandbox with a single command. Developer ready, zero config - The base image comes with optional extras https://devvm.dev/docs/using/customizing/ base-image-features that you choose, such as oh-my-bash, fzf, zoxide z , tree and tldr. - Every VM gets your git name and email, so the commits made in it are authored by you or your agent. - Ports forward on their own, so a dev server on :5173 in the VM opens at localhost:5173 on your machine ports https://devvm.dev/docs/using/ports-size/ ports . - devvm code opens the VM in VS Code over Remote-SSH devvm code https://devvm.dev/docs/using/ssh/ devvm-host-and-devvm-code . Isolated sandbox - The VM mounts your project folder at the same path. Apart from your agents’ settings from devvm’s own store, which it gets read-only, it sees nothing else in your home folder what a VM can reach https://devvm.dev/docs/safety/ what-a-vm-can-reach . - New VMs get the allowlist network tier https://devvm.dev/docs/safety/network/ by default, so they reach only an allowlist of hosts, through a proxy on your machine. You can choose a looser tier, internet or open, or a stricter one, none. - On macOS, devvm locks .git ’s hooks and config, so the VM can’t change what git runs on your machine .git protection https://devvm.dev/docs/safety/git-protection/ . - With --clone https://devvm.dev/docs/using/clone/ , the VM works on a clone of the repo of its own instead of your folder, so nothing in it can touch your working tree or .git , and its work reaches your repo only when you fetch it. - No sandbox closes every gap, so attack vectors https://devvm.dev/docs/safety/attack-vectors/ narrowed-not-closed lists what’s left open, and staying safe https://devvm.dev/docs/safety/ the-habits lists the habits that close most of it. Ready in seconds - The first VM builds a base image, and every later VM is a copy of it that starts in seconds images https://devvm.dev/docs/using/images/ . - devvm builds each version of a toolchain once and shares it read-only, so all VMs use the same copy shared tools https://devvm.dev/docs/using/images/ shared-tools . Made for coding agents - The agent runs in the VM, so an attack on it stays in the sandbox. It gets your settings, skills and MCP servers but never your history coding agents https://devvm.dev/docs/using/coding-agents/ . - On every network tier, their secrets, such as your Claude Code token and your Codex login, stay on your machine, because the VM gets placeholders and devvm’s proxy puts the real ones into its requests on the way out. Make it yours - Your own layers are setup scripts that devvm builds into an image: devvm layer new mailpit starts one, and devvm --layers mailpit makes a VM with it your own layers https://devvm.dev/docs/using/customizing/ your-own-layers . - devvm setup --layers gives every new VM the layers you choose, so your shell setup, aliases or dotfiles can go in a layer of your own that each VM gets unless you leave it out extras of your own https://devvm.dev/docs/using/customizing/ extras-of-your-own . - --from starts the base image from a container image instead of Ubuntu’s, such as node:24 or your team’s own starting from a container image https://devvm.dev/docs/using/from/ . - When the project has a devcontainer.json , devvm sets up its VM from the file’s container image, ports, environment and commands devcontainer.json https://devvm.dev/docs/using/devcontainer/ . FAQ What does it run on? devvm runs on macOS and on Linux, on arm64 or x86 64. It needs Lima https://lima-vm.io/ , which runs the VMs with Apple’s Virtualization framework on macOS and QEMU on Linux backends https://devvm.dev/docs/backends/ . Homebrew installs Lima along with devvm, and on Linux, Lima also needs QEMU and access to /dev/kvm . Installing https://devvm.dev/docs/getting-started/install/ lists every requirement, and known limits https://devvm.dev/docs/using/limits/ linux-hosts lists what Linux hosts lack, such as .git protection. Does the agent run on my machine? No. You start the agent in the VM’s shell, so it runs in the VM, and you never install it on your machine. There it sees only what the VM can reach https://devvm.dev/docs/safety/ what-a-vm-can-reach . Is it free? Yes. devvm is open source under the MIT license https://github.com/devvmhq/devvm/blob/main/LICENSE . Start coding in a sandbox Install devvm , then run devvm in any project folder.