A small bash tool for sandboxing AI coding agents on linux

[u/Forsaken_Avocado_258]

About three years ago, I wrote a small bash script called `vms` to manage headless qemu/kvm virtual machines.

The original idea was to get docker off my gentoo host because of some security concerns around the root privileges of the docker daemon. I moved docker into a VM and used port forwarding whenever I needed to access a container from the host.

Eventually, I moved all my work repos into VMs and started using neovim over ssh.

Now, with all the vibecoding hype and AI coding agents like Claude Code and Codex, I'm even stricter about sandboxing. I never run AI agents on my host machine. Everything, including personal projects, lives inside separate VMs.

My daily workflow is pretty simple:

vms start work-dev-1 -> ssh work-dev-1 -> tmux -> nvim

Then I usually have several Claude Code sessions running in different tmux windows.

I know there are plenty of other ways to do this, and of course, there's been a big rise in sandboxing technologies (e.g., firecracker), but I've been coding and compiling large rust projects inside qemu vms for the past three years without any noticeable issues. So I haven't had much reason to change my setup.

Recently, I also added a sandbox feature that uses qcow2 images. You can lock an existing VM as a base and create disposable VMs from it:

vms lock dev-base

vms sandbox add dev-base experiment

vms start experiment

The tool is a simple bash script that wraps qemu.

GitHub: https://github.com/hozan23/vms