introducing your agents get their own computer. on your mac. > disposable microVMs for Claude Code, Codex & Cursor > ready in 20 – 50ms > secrets never enter the box > runs 100% locally and it's open source 👀

source code:

Let's this is really cool man Congrats on launch

thank you bro :)

Really nice. Is this built on Apple's Containerization framework from WWDC25, or straight on Virtualization.framework? And how are secrets kept out, injected at runtime or never mounted at all?

- it's built on apple's virtualization.framework - yup secrets never enter the vm at all, it only sees placeholders and a host-side egress proxy swaps in the real value on the wire, only for that secret's allowed hosts spin up a vm for yourself sir

Placeholders plus a host-side swap is exactly how it should work. Definitely having a look at this, nice work.

A fresh microVM in 20-50ms means every agent task can get its own box and throw it away after. Keeping secrets outside the box should be the default everywhereeee

ill wait for linux support

will be rolling out soon 🫡

Less go bhaii re

thank you bhai 🥰

secrets never entering the box is the best part of this. nice one

Oss lessgo

thank you bhai :)

secrets staying outside the vm is what sold me. how does it work when the agent needs an api key halfway through a task, proxied?

Fast startup makes a fresh microVM per SI task practical. The payoff is cleaner state: leftover files and processes from one task don’t have to become the next task’s baggage.

20-50ms 就能起一个 microVM，还是纯本地跑，这个好🔥 让 agent 随便折腾，不怕把电脑搞炸 密钥不进沙箱这点我最喜欢，放心多了

the egress allowlist matters more than the 20-50ms to me. a sandboxed agent that can still curl anywhere will send your repo off if a readme tells it to, and swapping secrets in at the proxy so the vm never holds them is the right call

secrets never enter the box. my .env has been in every box i've ever touched

hey @grok, how to get this running with @AmpCode now that they support self-hosted orbs 👀

dope demo, what would be the main diff. vs docker?

Love the local microVM angle — secrets staying off the box is usually the part teams skip.

How do the agents call external APIs if secrets never enter the box?

"Secrets never enter the box" is the line that sells it. Most agent setups today are basically handing an intern root access and the .env file and hoping for the best.

This is crazyyyy man

"secrets never enter the box" is the line I'd test first. if the agent needs to call an API, does a proxy outside the VM inject the key, or does it get a short-lived token? and does 20-50ms still hold with a big repo mounted?

A box per agent limits what one can break. Running a few for my own tasks, what bit me was overlap: two picking up the same job. What fixed it: each checks a shared log before starting, and only one is allowed to message me.

vms r popular rn because they enable to run more than the local machine can handle -- not sure how this helps

local is the part i like most. every cloud sandbox wants your repo uploaded somewhere first, which kinda defeats the point of keeping secrets out

how this is diff from just using worktrees

One thing we've been pairing with sandboxes like this: a default-deny egress allowlist per run. Keeping secrets out of the box stops key theft, but a prompt-injected agent can still push repo contents to any URL it can reach.

secrets never entering the box is the line i'd lead with an agent wrecking a throwaway vm costs nothing. an agent reading your .env could cost a lot

20-50ms is fast enough to throw the vm away after every task, not every session. the catch is the agent's half installed node_modules goes with it, so i'd want to know if there's a warm cache layer or if every run pays the npm install again

This feels important

Keeping secrets out of the box is the right call. Most agent damage isn't the model going rogue, it's a token it can read ending up in a log or a command. How do you handle auth for things like git push, a proxy that injects creds on the way out?

Boxi 🥊

tryboxi is live! i was just talking to an ai engineer who runs codex and claude code all day and builds open source tooling around them. tried to dm you about an intro but it didn't go through

密钥不进盒子这点挺关键，开源了就更想自己拆开看看

This could bee used to make a local version of many of the cloud agents we have today. Thanks for the great work.

my agents run on one long-lived machine, and a lot of what makes it usable is state that piled up there, installed tools and logins. with the box thrown away after each task, what carries over? a warm package cache at least, or does every run pay the install again?

the agent can rm -rf / all it wants, that box only lived for 50ms anyway