# Sandbox: VM-isolated sandboxes for coding agents, built on Containerization + Virtualization.framework

**URL:** <https://forums.swift.org/t/sandbox-vm-isolated-sandboxes-for-coding-agents-built-on-containerization-virtualization-framework/89278>\
**Category:** Community Showcase\
**Created:** [August 30, 2026, 3:20pm UTC](https://forums.swift.org/t/sandbox-vm-isolated-sandboxes-for-coding-agents-built-on-containerization-virtualization-framework/89278 "2026-08-30T15:20:50Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![satishb](https://avatars.discourse-cdn.com/v4/letter/s/6f9a4e/32.png) [@satishb](https://forums.swift.org/u/satishb)\
**Post date:** [August 30, 2026, 3:20pm UTC](https://forums.swift.org/t/sandbox-vm-isolated-sandboxes-for-coding-agents-built-on-containerization-virtualization-framework/89278/1 "2026-08-30T15:20:50Z")

</div>

Hi all — I've been building an open-source tool in Swift I'd like to share.

**sandbox** runs coding agents (Claude Code, Codex, Gemini CLI, OpenCode) on Apple silicon inside lightweight VMs whose network egress they cannot bypass — even as root inside the guest. The problem it solves: agents work best unattended, but granting that on your own machine is the risk.

The interesting Swift part is _how_ the boundary is enforced. Apple's `containerization` package exposes a public `VZInterface` protocol; its stock `NATInterface` gives the guest a real route out. sandbox supplies a different conformer returning `VZFileHandleNetworkDeviceAttachment` — a virtio-net device whose wire is a datagram socket held by the sandbox process. The VM gets exactly one network device, so every flow terminates at a userspace gateway enforcing a default-deny allowlist, with DNS gating, SNI inspection, and credential injection at the TLS boundary. API keys never enter the guest — the agent sees a sentinel value, and the gateway substitutes the real credential only for verified upstreams.

Other bits that might interest this audience: sandbox rootfs disks are APFS copy-on-write clones (zero marginal disk per sandbox — starting one measurably changes free space by nothing), warm starts are ~0.5 s, each sandbox costs ~60 MB of host processes, and the whole thing is verified by ~165 end-to-end acceptance cases that run against live VMs on every change.

It's early (0.1.x) but complete for its first scope, and it also imports Docker Sandboxes kits (aider, code-server, …) as agent profiles. Apache licensed. Feedback, issues, and PRs are very welcome — especially from anyone who knows Virtualization.framework's darker corners.

```swift
curl -fsSL https://raw.githubusercontent.com/satishbabariya/sandbox/main/install.sh | sh
sandbox kernel install # guest kernel, ~280 MiB, once
sandbox doctor # checks everything at once
cd your-repo && sandbox run claude

```

> **[GitHub - satishbabariya/sandbox: Run coding agents in Apple Virtualization VMs...](https://github.com/satishbabariya/sandbox)**
>
> Run coding agents in Apple Virtualization VMs whose network egress they cannot bypass. Enforcement lives outside the guest, so it holds even against root with every capability.