Zevbox — Development skill for Claude Code

zevbox — run AI coding agents for Zed inside Apple Container micro-VMs

**English** · [Français](docs/fr/README.md)

**zevbox** lets you use ACP agents (**Claude Code**, **Google Antigravity**) from the [Zed](https://zed.dev) editor while keeping them off your Mac. Each agent runs inside a disposable **Apple Container** Linux micro-VM — a real hardware-isolated virtual machine, not a shared-kernel container — and talks to Zed through a **filtering ACP relay** that strips every request which would let the agent read, write or execute anything on the host through the editor.

Single Rust binary · macOS on Apple Silicon (arm64) · no daemon · no Docker.

---

Why

When Zed starts an ACP agent the normal way, the agent runs **as you, on your Mac**. It can read `~/.ssh`, `~/.aws`, your keychain-backed CLIs and environment variables; it can run any command; and the ACP protocol itself lets it ask the editor to read, write and execute on its behalf (`fs/*`, `terminal/*`). One prompt injection in a README you asked it to summarise is enough.

zevbox gives the agent exactly two things — **your project directory** and **its own state directory** — and nothing else:

	Agent run by Zed directly	Agent inside zevbox
Your ~/.ssh, ~/.aws, keychain, other projects	readable	not mounted, not visible
Shell on the Mac	yes	no — commands run inside a throwaway Linux VM
fs/*, terminal/* ACP requests to Zed	honoured	blocked by the relay (I3)
Files created outside the project	land on your Mac	gone when the VM exits
File ownership of project edits	your user	your user (same UID/GID, no root-squash)
Agent start-up	instant	< 1 s (micro-VM boot)

What it looks like

flowchart LR
    subgraph Host ["Your Mac (macOS, Apple Silicon)"]
        Zed["Zed editor"]
        Relay["zevbox relay\n(single Rust binary)"]
        Project["Allowed project\ndirectory"]
        State["Agent stat