Dev Sandbox

dev-sandbox

**Run AI coding agents in isolated Podman containers, optionally with krun microVMs.**

For Linux distributions with Podman support. Developed and tested on Fedora 44.

One self-contained bash script. No dependencies beyond Podman. Configure profiles, build, run — everything in a single file.

Why

AI coding agents need shell access and run arbitrary code. Without isolation:

• An agent can read ~/.ssh/, ~/.aws/, browser cookies, API keys
• A malicious pip package in setup.py can exfiltrate data silently
• Prompt injection in a file can instruct the agent to run destructive commands
• You have no visibility into what network connections the agent makes

dev-sandbox runs each agent in its own isolated environment with only the current project directory visible.

What this does **not** prevent: an agent can write to `.git/hooks` and persistent volumes, which execute on the next run. See [docs/SECURITY.md](docs/SECURITY.md).

Quick start

# Install (Fedora/RHEL)
sudo dnf install podman crun-krun

# Install (Ubuntu/Debian)
sudo apt install podman

# Download
curl -o ~/.local/bin/dev-sandbox https://raw.githubusercontent.com/kosmrljt/dev-sandbox/main/dev-sandbox.sh
chmod +x ~/.local/bin/dev-sandbox

# Run from your project directory (only this directory is visible inside the sandbox)
cd ~/my-project
dev-sandbox                      # with krun (Fedora)
dev-sandbox --no-krun            # without krun (Ubuntu or any Linux)

The first run builds images (~1.6 GB, several minutes). Subsequent runs start in seconds. The default profile is configured for Claude Code — edit the script to change.

Once inside, you are in an isolated container:

[claude] /app/my-project--[HASH]$          ← colored prompt shows profile name

• You are user dev, not your host user
• Only your project directory is visible (mounted at /app/...)
• Your home directory, SSH keys, and other host files are not accessible
• pip packages, credentials, and co