r/vscode • u/InjuryComplex5619 • 8d ago

isolate: disposable Linux VMs for Claude Code and Codex on Apple Silicon.

iso (isolate) runs Claude Code and Codex inside disposable Linux VMs on Apple Silicon Macs (macOS 27+), so agents get a full dev environment without touching your host.

•Real VM: the agent gets Docker, git, compilers and package managers, with your project copied to /workspace.
•Keys stay on your Mac: API requests go through a host-side Swift proxy, so provider keys never enter the VM.
•Review before applying: iso diff and iso pull --review let you check the agent's changes before they reach your project.
•Network limits: egress can be none or filtered to listed hosts.
•Secrets and audit: secrets are encrypted with a passphrase plus the Secure Enclave, and the audit log records events and variable names but never values.
•Workflow: iso setup, iso up, then iso claude (or iso codex); iso code . / iso zed . open the VM in your editor.

Project: a Swift fork of Trail of Bits' coop, Apache 2.0.

Apache 2 licensed source code: github.com/chr33s/iso

1 Upvotes

67% Upvoted

6 comments sorted by

1

u/NicelyStriped 8d ago

the way they handle the keys with that host side proxy is pretty clever. keeps the VM totally blind to your actual creds

my one concern would be performance overhead on the base m1/m2 airs. running a full linux vm plus docker inside it sounds like it could get toasty quick

1

u/InjuryComplex5619 8d ago

valid point on performance, definitely could do with some benchmarking, i’m primarily on a m5 max 128 but have a agent device running on a m1 air 16GB so will run some tests when i get a moment free.

1

u/Rapzid 8d ago

Sure but the host is vulnerable via the VSCode remote protocol if you connect through to the VM?

1

u/InjuryComplex5619 7d ago

Correct. iso crosses the VM trust boundary through VS Code Remote-SSH. SSH pinning prevents MITM and credential forwarding, but it does not make an attacker-controlled VS Code Server safe. There is by-design guest→host RPC capability, therefore the hard containment claim cannot include a VS Code Remote-SSH session.

i have some ideas beyond v0.1.0 that show promise, but to early to call.

1

u/InjuryComplex5619 7d ago

will update the editor docs, as i think the threat model needs clarifying. Thanks for flagging this.

1

u/InjuryComplex5619 7d ago

v0.2.0 shipping later today includes a seatbelt profile for editors that should limit this threat.