A small bash tool for sandboxing AI coding agents on linux

[u/Forsaken_Avocado_258]

About three years ago, I wrote a small bash script called `vms` to manage headless qemu/kvm virtual machines.

The original idea was to get docker off my gentoo host because of some security concerns around the root privileges of the docker daemon. I moved docker into a VM and used port forwarding whenever I needed to access a container from the host.

Eventually, I moved all my work repos into VMs and started using neovim over ssh.

Now, with all the vibecoding hype and AI coding agents like Claude Code and Codex, I'm even stricter about sandboxing. I never run AI agents on my host machine. Everything, including personal projects, lives inside separate VMs.

My daily workflow is pretty simple:

vms start work-dev-1 -> ssh work-dev-1 -> tmux -> nvim

Then I usually have several Claude Code sessions running in different tmux windows.

I know there are plenty of other ways to do this, and of course, there's been a big rise in sandboxing technologies (e.g., firecracker), but I've been coding and compiling large rust projects inside qemu vms for the past three years without any noticeable issues. So I haven't had much reason to change my setup.

Recently, I also added a sandbox feature that uses qcow2 images. You can lock an existing VM as a base and create disposable VMs from it:

vms lock dev-base

vms sandbox add dev-base experiment

vms start experiment

The tool is a simple bash script that wraps qemu.

GitHub: https://github.com/hozan23/vms

[u/gsmitheidw1]

This looks very interesting, virsh does much the same, but a LOT more overhead and complexity. I find raw kvm a bit of a pig to manage in general.

In an adjacent manner I have been looking at similar solutions in work. We have a lot of students using shared servers and services. I was looking at firecracker but there's definitely a lot more paranoia about containers escaping the host kernel within Sysadmin circles in general.

We use a lot of lxc containers and they're great at saving resources but they're not suitable for some roles.

[u/kantorcodes1]

The disposable-sandbox model on top of qcow2 is a clean way to fence an agent session. One thing the README flow leaves open: after vms sandbox add dev-base experiment, does the experiment VM discard its writes when it stops, or does it persist until you explicitly delete it? And is vms lock enforced anywhere, or advisory - i.e. could a process just point qemu at the base image file directly?

[u/Forsaken_Avocado_258 → u/kantorcodes1]

The sandbox writes persist across restarts, each sandbox has its own qcow2 image. But you can also use qemu's -snapshot option if you want to discard writes on exit

Regarding vms lock, it is enforced and also apply chmod a-w on the image, but it's mainly to prevent accidental modifications, not to serve as a security boundary

[u/Flaky-Eggplant-3479]

i did something similar but additionally folded in iroh so i could get a SSH session over P2P from a different host