I think this sort of thing can still be useful to smaller shops. I have a hobby project in this vein, and I know it will never make it big, but it's still a fun hamster wheel.

One thing I'm struggling with at the moment which I may as well ask here.

Many of my projects use pnpm, which ideally uses hard links from a shared store of dependencies.

One of my goals is to reduce the disk overhead of VM based isolation, so I'd like a shared pnpm store across projects (and the same for maven, etc as well)

With https://virtio-fs.gitlab.io/ mounts, each mount inside the VM is a separate FS, and I can't hard link across them. I've tried playing around with ideas like bind mounting the directory structure from the host in a folder to have a single virtio-fs mount inside the VM - but the bind mounts still can't be hard linked across it seems.

I'm basically wondering if I'm missing something or just trying to do something that isn't possible.

All the host folders are on the same FS - but I don't want to organise the host system around the VM mounting needs, and I also don't want to mount extraneous directories into the VM (eg: simple solution could be just mount ~/projects but kinda self defeating)

(Fedora workstation host)

Also been working on something similar, with qemu/kvm; the idea is to sandbox agents and limit resource usage per project. Its not production-ready yet, but the repo is public - https://github.com/blackshieldpt/catchpen

add me as well. I learned about incus from HN ~a month ago, and was poking an idea of having a "development base image". The advantage compared to containers, is that you can hot-plug devices to the running instance: mounts, secrets, etc. incus also supports --vm and container mode with minimal difference in cli commands.

https://linuxcontainers.org/incus/

my main bottleneck was exactly in usability: how to make it least effort to spin up per use case and keep the set of operating scripts small - i didn't want to build an app for this, just shortcuts to use existing app.

Add me to the list, although I use podman containers (https://github.com/evertheylen/probox). I find that the hard part is not restricting the container/VM, but to make it "easy" to do things in the container that require something protected. How will you commit? Where does your agent run, and can it access github? How will you deploy? How will you SSH to a server?

Happy to hear what other people are thinking. It seems like putting an intercepting HTTP proxy is getting popular in other projects.

Somebody shared this in another thread: https://pleasedonotescape.com/

I guess they can add all the sibling comments to the list, as well as mine: https://github.com/AdrianVollmer/Agent-Sandbox

(Python, Podman, Squid for network filtering)

Add me to the list lmao. It seems like this is pretty popular among folks

Ha, add me to the list. I built one with libvirt and cloud-init too, mostly focused on network containment (private/host networks are blocked) and VM hardening. There's also a check command that runs nmap from inside the VM to verify nothing private is reachable.

https://github.com/ertug/kvm-sandbox

I also moved to smolvm.

That project is underrated.

I have built my agent harness around smolvm and it has been working wonderfully.

I have seen a single bug up to now (iirc you cannot take a snapshot from a machine you rehydrate from a pack) but found a workaround.

I think the only thing I would love a solution for is the ability to bind credentials even when you use tailscale. You cannot right now because the traffic goes through the tailscale interface.

Anyway. smolvm is simply amazing.

This is something that could run on top of smolvm, if the authors chose it, rather than Lima/QEMU. It both sets up virtual machines and what goes into them, letting you chooose toolchains and coding agents. smolvm doesn't provide dev tool setup within a vm, though it does point to images that already have toolchains and agents installed.

I missed the one directory part, I'd definitely recommend making that more flexible. With my equivalent of this I often mount multiple repositories into a single VM, two examples:

- a bunch of gitops repos: terraform mono repo, argocd-esk conf repo, grafana provisioning repo, etc.

- frontend + backend repo (tbh may merge these to a mono-repo, but here we are)

I think the auto detection is interesting, but tbh with my solution I've been happy with just install all the tools regardless of what a specific project needs - with a COW base layer this is cheap.

fyi, docker sandbox is CLOSED SOURCE, in the year of our lord 2026

https://github.com/docker/sbx-releases

That's a layer of protection, but it still exposes your real Linux kernel to the sandbox, and that's more CVEs than I'd consider ideal.

right chain of tought, but systemd is the only to truly leverage linux namespaces capabilities, allowing private networks, other rootfs, etc

bwrap has a lot of sharp edges that can bite you, if you're not aware of them.

bubblewrap is linux only and offers a fraction of isolation of a microvm