A developer has described a setup that gives each project folder its own virtual machine, so AI coding agents operate inside an isolated sandbox rather than directly on the user's computer.
AI coding agents · Sandboxing
One virtual machine per project, so coding agents never run directly on your computer
A developer describes an isolation setup in which each project folder gets its own VM. Agents run commands, install packages and edit files inside that sandbox, with only the project folder mounted, network access limited to an allowlist, and secrets kept on the host.
How the described boundary is drawn
Host machine
Secrets
API keys and credentials stay here
Rest of filesystem
Not exposed to the VM by default
→
Per-project VM
AI agent
Runs shell commands, installs packages, edits files
Mounted project folder
The only host path the VM can see
Network allowlist
Only approved destinations are reachable
Two failure modes the design targets
Unintended damage
Agents with full user permissions can alter or delete files well beyond the task. A VM limits writes to the mounted project.
Credential leakage
If secrets are not inside the agent's environment, they cannot be read or sent out from it. Keeping them on the host addresses this.
What the description claims
Agents operate inside a VM, not on the host
Only the project folder is mounted
Outbound access is restricted by allowlist
Secrets remain on the host machine
What remains unverified
Reliability and compatibility with specific agents
Ease of setup
VM startup overhead and performance
Effort to share data or tools with the host
Key open question
Whether the approach holds up depends on details not yet given
What the tool's project configuration detection actually covers
Independent testing, benchmarks or user feedback
The tool's name and availability
Continue reading The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in ✓ Signed in — this article isn’t included in your current plan.Unlocking the full article...