brood-box

Brood Box

**Warning** This project is **EXPERIMENTAL**. APIs, CLI flags, config format, and behavior may change without notice between releases. Use at your own risk and please report issues.

Run coding agents in hardware-isolated microVMs. Review every change before it touches your workspace.

[](LICENSE) [](https://github.com/stacklok/brood-box/actions/workflows/ci.yaml) [](https://goreportcard.com/report/github.com/stacklok/brood-box) [](https://www.repostatus.org/#experimental)

Table of Contents

• Why?
• Features
• Quick Start
• Usage
• Configuration
• Egress Firewall
• Supported Agents
• How It Works
• Security Model
• Documentation
• Building from Source
• Contributing
• License

Why?

Coding agents are powerful, but they need access to your workspace, your API keys, and the ability to run arbitrary code. That's a lot of trust to hand over.

Containers help, but they share the host kernel. One escape and you're done.

Enter **Brood Box**. It boots a lightweight microVM (via [libkrun](https://github.com/containers/libkrun) and KVM), mounts a copy-on-write snapshot of your workspace, forwards only the secrets you specify, and lets you review every file change before it lands. Hardware isolation with the feel of a local terminal.

bbox claude-code

And that's it. You get a full interactive session with Claude Code running inside a VM. When the agent exits, you review the diff and accept or reject each file.

Features

• Hardware-isolated microVMs -- KVM (Linux) and Hypervisor.framework (macOS) backed VMs via libkrun, not just containers
• Workspace snapshot & review -- COW snapshot so the agent never touches your real files; interactive per-file review with unified diffs when it's done

...