Home 零对冲(ZeroHedge)每日HackerNews

Devvm.dev: 每个项目一个虚拟机
Devvm.dev: One VM for every project

原始链接: https://devvm.dev/

devvm 是一个免费、开源的工具，可在几秒内为项目文件夹创建隔离的虚拟机。它会自动检测所需的工具链，在虚拟机内运行编程代理（Claude Code、Codex、opencode），并仅以读写方式挂载项目，同时将敏感主目录和密钥保留在外部。网络访问通过你机器上的带允许列表的代理进行，代理会注入编程代理的凭据，而不是将其存储在虚拟机中。它支持自定义层、devcontainer.json、端口转发、VS Code Remote-SSH、git 身份，以及通过共享工具链快速复用虚拟机。基础镜像只需构建一次，因此后续虚拟机启动更快。它支持 macOS 和 Linux，并在需要时依赖 Lima/QEMU。其目标是通过合理的默认设置和单一命令，为代码和代理提供安全沙箱。

Hacker News 帖子讨论了 Devvm.dev，这是一个每个项目提供一个虚拟机的工具。虽然有些人认为它对小团队有价值，但其他人认为它缺乏企业功能，如安全访问内部注册表、多仓库工作流、GPU/内存 ballooning、RDP 和凭证注入。评论者分享了许多类似的沙箱项目（smolvm、libvirt/cloud-init、Incus、Podman、Docker sbx、qemu/KVM），并就虚拟机与容器或命名空间进行辩论。关键问题包括隔离与便利性、密钥处理、git-hook 风险、磁盘效率和开发者工作流。几位用户正在构建类似工具；其他人更喜欢成熟的平台或基于 cloud-init 的虚拟机。总体而言，对话反映了对安全、简单的 AI 代理和开发沙箱的强烈需求，但尚未达成最佳方案的共识。
相关文章
原文
Free and open source

An isolated sandbox with your project’s toolchain, ready for you or a coding agent to start coding.

Install Read the docs

On your machine, you run devvm in ~/web, and ~/.ssh, ~/.aws and ~/Documents stay out of the VM. In the VM's shell, whose prompt starts with (devvm), you run claude: the agent runs there, with the project folder mounted read-write and your agents' skills and settings read-only. Its network goes through a proxy on your machine, which adds your token and lets out to the internet only what its allowlist allows.your machine~/web $devvm× ~/.ssh× ~/.aws× ~/DocumentsVM(devvm) ~/web $claude█~/webrwskillsrosettingsrotokenproxyallowlist

Quick start

1. Go to your project

Open a terminal and cd into any project folder.

In a terminal on your machine, you type cd ~/some-project.your machine~ $cd ~/some-project█

2. Run devvm

devvm shows what the new VM gets. Confirm to make it, or customize it.

You type devvm, and it shows what the folder's new VM gets: the toolchain node, the agent claude, its size and the network tier allowlist. It asks Customize it? [y/N], and you press enter to make the VM.your machine~/some-project $devvm█This folder's new VM gets:toolchain nodeagent claudesize: 4 CPUs, 8 GiB memorynetwork tier: allowlistCustomize it? [y/N]enter

3. Start your agent

devvm opens a shell in the VM, whose prompt starts with (devvm), so start your agent there.

In the VM's shell, whose prompt starts with (devvm), you type claude.VM(devvm) ~/some-project $claude█

Claude Code needs your Claude login before its first start, which devvm agent login claude makes from the VM and keeps on your machine (your first VM). The next time you run devvm in the folder, it opens the same VM, and devvm tools adds an agent to a VM you already have.

What’s supported

Toolchains

devvm chooses the toolchains your project’s files call for, and you can choose more when you customize a new VM or name them with --tools (toolchains).

A folder, ~/web, with package.json and pyproject.toml gets node and python: devvm reads the folder's files.~/webpackage.jsonpyproject.tomlnodepython

Coding agents

Claude Code, Codex and opencode run in the VM. Choose one when you customize a new VM, or choose them for every new VM in devvm setup (coding agents).

A terminal in a VM runs claude in ~/web. claude, codex and opencode are ready in it.VM~/web $claude█claudecodexopencode

Layers

devvm ships the docker, nix and desktop layers, which you choose when you customize a new VM, and devvm layer new creates your own custom layers you can apply to any of your VMs (layers).

The image docker+nix is the nix layer on the docker layer, on base. docker, nix and desktop are the built-in layers.docker+nixnixdockerbasedockernixdesktop

Why use devvm?

Without devvm, a prompt injection, leaked secrets, a supply chain attack and a rogue agent reach your machine one after another, and each one compromises what it reaches: the project, ~/web, then ~/.aws, ~/.ssh and another project, ~/api. With devvm, the project is in a VM, and the same four attacks reach the VM. Each one's path toward your machine ends at the VM's border, so ~/.ssh, ~/.aws and ~/api stay untouched.without devvmyour machineprompt injectionleaked secretssupply chainrogue agent~/web~/.aws~/.ssh~/apiwith devvmyour machineVM~/web~/.ssh~/.aws~/apiprompt injectionleaked secretssupply chainrogue agent××××

Developer ready, zero config

  • The base image comes with optional extras that you choose, such as oh-my-bash, fzf, zoxide (z), tree and tldr.
  • Every VM gets your git name and email, so the commits made in it are authored by you or your agent.
  • Ports forward on their own, so a dev server on :5173 in the VM opens at localhost:5173 on your machine (ports).
  • devvm code opens the VM in VS Code over Remote-SSH (devvm code).
In the VM devvm-web, npm run dev is ready on :5173, and a browser on your machine opens it at localhost:5173. devvm code opens the VM in your editor over SSH. A commit made in the VM has you as its author.your machinelocalhost:5173▓▓▓▓ ░░░░░░░░devvm codeSSH: devvm-web←───ports───────ssh────→devvm-web❯npm run devready on:5173❯git commitAuthor:you❯█

Isolated sandbox

  • The VM mounts your project folder at the same path. Apart from your agents’ settings from devvm’s own store, which it gets read-only, it sees nothing else in your home folder (what a VM can reach).
  • New VMs get the allowlist network tier by default, so they reach only an allowlist of hosts, through a proxy on your machine. You can choose a looser tier, internet or open, or a stricter one, none.
  • On macOS, devvm locks .git’s hooks and config, so the VM can’t change what git runs on your machine (.git protection).
  • With --clone, the VM works on a clone of the repo of its own instead of your folder, so nothing in it can touch your working tree or .git, and its work reaches your repo only when you fetch it.
  • No sandbox closes every gap, so attack vectors lists what’s left open, and staying safe lists the habits that close most of it.
On your machine, ~/.ssh, ~/.aws and ~/Documents aren't mounted. Only the project folder, ~/web, goes into its VM, read-write, where .git is locked. The VM's network goes through a proxy on your machine, which lets out to the internet only what its allowlist allows.your machine× ~/.ssh× ~/.aws× ~/Documents~/webVM~/webrw.gitlockedproxyallowlist

Ready in seconds

  • The first VM builds a base image, and every later VM is a copy of it that starts in seconds (images).
  • devvm builds each version of a toolchain once and shares it read-only, so all VMs use the same copy (shared tools).
The base image is built once. Each VM, devvm-web, devvm-api and devvm-cli, is a copy of it, up in seconds. node, python, go, rust and claude are shared between them, read-only.base▓▓▓▓▓▓▓▓░▒devvm-web■ updevvm-api■ updevvm-cli■ upnodepythongorustclauderead-only

Made for coding agents

  • The agent runs in the VM, so an attack on it stays in the sandbox. It gets your settings, skills and MCP servers but never your history (coding agents).
  • On every network tier, their secrets, such as your Claude Code token and your Codex login, stay on your machine, because the VM gets placeholders and devvm’s proxy puts the real ones into its requests on the way out.
Your agents' skills are mounted into the VM read-only, their settings and MCP servers copied in, for claude, codex and opencode. Your history stays on your machine. Your token stays on your machine: the VM has a placeholder, and the proxy adds the token on the way to the API.your machineskillssettingsMCP serverstoken─────ro────→────copy───→────copy───→historystays────×proxy↓APIVMclaudecodexopencode░░░░░░░

Make it yours

  • Your own layers are setup scripts that devvm builds into an image: devvm layer new mailpit starts one, and devvm --layers mailpit makes a VM with it (your own layers).
  • devvm setup --layers gives every new VM the layers you choose, so your shell setup, aliases or dotfiles can go in a layer of your own that each VM gets unless you leave it out (extras of your own).
  • --from starts the base image from a container image instead of Ubuntu’s, such as node:24 or your team’s own (starting from a container image).
  • When the project has a devcontainer.json, devvm sets up its VM from the file’s container image, ports, environment and commands (devcontainer.json).
A stack: the base image at the bottom, with your features, dotfiles and aliases, built in; your layer, mailpit, on it; and on top the VM devvm-web, made with node+mailpit. A container image, node:24, starts the base image with --from.container imagenode:24--fromdevvm-webnode+mailpitmailpityour layerbaseyour featuresdotfilesaliases

FAQ

What does it run on?

devvm runs on macOS and on Linux, on arm64 or x86_64. It needs Lima, which runs the VMs with Apple’s Virtualization framework on macOS and QEMU on Linux (backends). Homebrew installs Lima along with devvm, and on Linux, Lima also needs QEMU and access to /dev/kvm. Installing lists every requirement, and known limits lists what Linux hosts lack, such as .git protection.

Does the agent run on my machine?

No. You start the agent in the VM’s shell, so it runs in the VM, and you never install it on your machine. There it sees only what the VM can reach.

Is it free?

Yes. devvm is open source under the MIT license.

Start coding in a sandbox

Install devvm, then run devvm in any project folder.

Install Read the docs

联系我们 contact @ memedata.com