devvm.dev offers a free, open-source tool that creates an isolated virtual machine for each project, keeping your host system safe from code and agent threats. By running projects inside a sandboxed VM, devvm prevents attacks like prompt injections, leaked secrets, and supply chain compromises from reaching your machine's sensitive directories like ~/.ssh and ~/.aws. The setup is remarkably simple: navigate to a project folder and run `devvm`, which automatically detects required toolchains (like Node or Python) and configures the VM with sensible defaults. You can then launch coding agents like Claude Code, Codex, or opencode directly within the secure environment.
The tool supports customizable layers, including Docker, Nix, and desktop environments, and allows users to create their own custom layers. It integrates with your local machine by mounting the project folder read-write while keeping agent skills and settings read-only. Network access is strictly controlled through a proxy with an allowlist, ensuring only necessary outbound connections are permitted. With zero configuration needed, developers can quickly establish a secure coding environment that isolates project work from critical system files and other projects.
Source: Hacker News · Summarized by HeadlinesBriefing