Hi all — I've been building an open-source tool in Swift I'd like to share.
sandbox runs coding agents (Claude Code, Codex, Gemini CLI, OpenCode) on Apple silicon inside lightweight VMs whose network egress they cannot bypass — even as root inside the guest. The problem it solves: agents work best unattended, but granting that on your own machine is the risk.
The interesting Swift part is how the boundary is enforced. Apple's containerization package exposes a public VZInterface protocol; its stock NATInterface gives the guest a real route out. sandbox supplies a different conformer returning VZFileHandleNetworkDeviceAttachment — a virtio-net device whose wire is a datagram socket held by the sandbox process. The VM gets exactly one network device, so every flow terminates at a userspace gateway enforcing a default-deny allowlist, with DNS gating, SNI inspection, and credential injection at the TLS boundary. API keys never enter the guest — the agent sees a sentinel value, and the gateway substitutes the real credential only for verified upstreams.
Other bits that might interest this audience: sandbox rootfs disks are APFS copy-on-write clones (zero marginal disk per sandbox — starting one measurably changes free space by nothing), warm starts are ~0.5 s, each sandbox costs ~60 MB of host processes, and the whole thing is verified by ~165 end-to-end acceptance cases that run against live VMs on every change.
It's early (0.1.x) but complete for its first scope, and it also imports Docker Sandboxes kits (aider, code-server, …) as agent profiles. Apache licensed. Feedback, issues, and PRs are very welcome — especially from anyone who knows Virtualization.framework's darker corners.
curl -fsSL https://raw.githubusercontent.com/satishbabariya/sandbox/main/install.sh | sh
sandbox kernel install # guest kernel, ~280 MiB, once
sandbox doctor # checks everything at once
cd your-repo && sandbox run claude