Devvm.dev: One VM for every project
190 points
• 6 days ago
• Article
Link
Devvm 是一款开源工具，旨在为开发人员的编码工作流程提供隔离的、特定于项目的虚拟机沙盒。通过在 VM 内运行开发环境，你可以有效限制潜在安全威胁的影响范围，比如供应链攻击、泄露的密钥（secrets）或被入侵的代码代理。尽管这类工具很有用，但往往会带来繁琐的配置门槛。 Devvm 通过提供合理的零配置默认值来解决这个问题，让你只需一条命令就能建立一个安全、可直接使用的沙盒环境。
当你在项目文件夹中启动 devvm 时，它会创建一个封闭的环境，只挂载你的项目文件，从而让诸如 SSH keys 、 AWS credentials 和个人文档之类的敏感本地数据完全隔离。该 VM 通过主机上的专用代理（proxy）运行，由代理通过严格的网络允许列表（allowlists）来控制互联网访问。为进一步提升安全性，系统会在 macOS 上锁定 git hooks 和相关配置，确保在沙盒中执行的代码无法篡改你机器的主要 git 设置。
平台以高效为设计目标，最大限度减少日常使用中的摩擦。由于基础镜像只构建一次，后续的 VM 能在几秒内生成。 Devvm 支持多种项目需求，会根据你的项目文件自动检测所需的工具链，例如 Node.js 或 Python 。它还支持 Claude Code 、 Codex 、 OpenCode 等流行的代码代理，并将它们限制在 VM 的安全边界内运行。这些代理可以访问你的设置和技能，但它们无法接触到你的本地历史记录和私人机器数据。
自定义依然是核心能力，允许开发人员通过自定义 layers 扩展环境。你可以为 mailpit 等工具编写特定的设置脚本，加入你喜欢的 dotfiles，甚至可以让 VM 以已有的容器镜像（例如 Node:24）为基础。此外，如果你的项目已经使用了 devcontainer.json，devvm 可以自动解析该文件，用于配置 VM 的环境、端口和依赖项。这样既能保证沙盒安全且标准化，又能根据你的项目独特需求进行调整。
devvm 会通过直观的功能与你现有工作流程无缝衔接，比如自动端口转发，确保在 VM 中运行的服务可以通过主机上的 localhost 进行访问。你也可以使用 VS Code over Remote-SSH 等工具直接与 VM 交互。 devvm 构建在 Lima 之上，可在 macOS 和 Linux 上运行，在不同架构之间保持一致的使用体验。通过把虚拟化的复杂性隐藏在简单的 CLI 之后，devvm 让每一个你正在进行的项目都能轻松采用沙盒化的最佳实践。
Devvm is an open-source tool designed to provide developers with isolated, project-specific virtual machine sandboxes for their coding workflows. By running your development environment inside a VM, you effectively limit the blast radius of potential security threats like supply chain attacks, leaked secrets, or compromised coding agents. While these tools offer significant utility, they often introduce complex configuration hurdles. Devvm bypasses this by offering sensible, zero-configuration defaults, allowing you to establish a secure, sandbox-ready environment with a single command.
When you launch devvm within a project folder, it creates a contained environment that mounts only your project files, keeping sensitive local data like your SSH keys, AWS credentials, and personal documents completely isolated. The VM operates through a specialized proxy on your host machine, which enforces strict network allowlists to govern internet access. For added security, the system locks git hooks and configurations on macOS, ensuring that code executing inside the sandbox cannot alter your machine's primary git settings.
The platform is designed to be highly efficient, minimizing friction in your daily routine. Because the base image is built once, subsequent VMs are generated in seconds. Devvm supports a wide variety of project requirements, automatically detecting necessary toolchains such as Node.js or Python based on your project files. It also supports popular coding agents like Claude Code, Codex, and OpenCode, running them within the secure confines of the VM. These agents gain access to your settings and skills, but they remain isolated from your local history and private machine data.
Customization remains a core feature, allowing developers to extend their environments through custom layers. You can define specific setup scripts for tools like mailpit, include your preferred dotfiles, or even base your VM on existing container images like Node:24. Furthermore, if your project already utilizes a devcontainer.json file, devvm can automatically parse it to configure the VM's environment, ports, and dependencies. This flexibility ensures that while the sandbox is secure and standardized, it can still adapt to the unique needs of your specific project.
Integration with your existing workflow is handled through intuitive features, such as automatic port forwarding, which ensures that services running in the VM are accessible at localhost on your host machine. You can also use tools like VS Code over Remote-SSH to interact with the VM directly. Built on top of Lima, devvm runs on both macOS and Linux, maintaining a consistent experience across different architectures. By keeping the complexity of virtualization hidden behind a simple CLI, devvm makes the best practices of sandboxing accessible for every project you undertake.
79 comments • Comments Link
- 为 AI agents 构建隔离沙盒环境是一个常见痛点，很多开发者会各自独立地用 libvirt 、 QEMU 、 KVM 或 podman 搭建类似方案，用来管理资源受限的执行环境。
- 真正的企业级隔离不只是容器本身。它还需要内存气球（memory ballooning）、 GPU 加速、安全的凭据注入以及出口过滤（egress filtering），以防止 agents 访问未授权的基础设施、注册表或内部机密。
- 一个关键难题是在安全性与实用性之间取舍：完全的强约束会让 agents 失去效果，而权限过于宽松又会带来巨大风险。为此，许多开发者把 agents 当作"权限有限的实习生"来处理，比如使用分支保护，或在 GitHub 上采用单独的、受限制的机器账户。
- 在管理多台 VM 时，磁盘开销会成为现实障碍。依赖支持写时复制（CoW）的宿主文件系统，并优化依赖项（如 pnpm stores）在隔离环境之间的共享方式，是提高效率的重要策略。
- 社区里主要存在两种分歧：一类倾向于使用预配置工具链的"golden images"；另一类则更偏向高层级的自动化方案，目标是简化开发体验，但会在一定程度上牺牲灵活性。
- 关于"curl-to-shell"安装方式以及不透明闭源工具的安全担忧仍然很高。许多开发者更倾向于使用可审计或可自行构建的方案，偏爱像 `smolvm` 这样简单且便于嵌入的工具。
- 工作流集成的管理——尤其是让 IDE（如 VS Code 或 IntelliJ）能够与 VM 内部代码无缝交互，同时保持安全的实时热重载与调试——是实现大规模采用的主要瓶颈。
- 底层技术的选择——在轻量级 namespaces/bubblewrap 与重量级 micro-VM 之间——取决于用户的威胁模型。尽管 namespaces 在资源效率上更占优势，但 micro-VM 能在内核层面对潜在主机漏洞提供更强隔离。
上述讨论反映了整个行业为破解 AI 辅助开发中的"沙盒困境"所做的广泛努力。尽管业界已形成共识：在隔离环境中运行 agents 对安全至关重要，但由于易用性、性能以及"安全与实用性"之间的矛盾，目前仍没有单一工具能在市场中占据主导地位。大多数参与者更倾向于自建模块化技术栈——通常依赖 libvirt 、 cloud-init，或使用像 smolvm 这样的专门项目——以便对自身特定工作流需求和威胁模型保持可控性。 • The development of isolated, sandbox environments for AI agents is a common pain point, with many developers independently creating similar solutions using libvirt, QEMU, KVM, or podman to manage resource-constrained execution.
• True enterprise-grade isolation requires more than just basic containers. It demands memory ballooning, GPU acceleration, secure credential injection, and egress filtering to prevent agents from accessing unauthorized infrastructure, registries, or internal secrets.
• A significant challenge is balancing security with utility. Total restriction renders agents ineffective, while loose permissions create severe risk. Many developers address this by treating agents like "interns" with scoped access, using branch protection, or employing separate, restricted machine accounts on GitHub.
• Disk overhead is a practical hurdle when managing multiple VMs. Relying on host filesystems that support Copy-on-Write (CoW) and optimizing how dependencies (like pnpm stores) are shared across isolated environments are key strategies for efficiency.
• There is a split in the community between those who prefer "golden images" with pre-configured toolchains and those who favor high-level, automated setup projects that aim to streamline the developer experience at the cost of some flexibility.
• Security concerns regarding "curl-to-shell" installation methods and opaque closed-source tools remain high. Many developers prefer solutions they can audit or build themselves, favoring tools like `smolvm` for their simplicity and embeddability.
• Managing workflow integration—specifically enabling IDEs (like VS Code or IntelliJ) to interact seamlessly with code inside a VM while maintaining secure hot-reloading and debugging—is the primary bottleneck for widespread adoption.
• The underlying technology choice—between lightweight namespaces/bubblewrap and heavy micro-VMs—depends on the user's threat model. While namespaces are more resource-efficient, micro-VMs provide better kernel-level isolation against potential host exploits.
The discourse reflects a widespread, industry-wide effort to solve the "sandbox dilemma" for AI-assisted development. While there is a clear consensus that executing agents in isolated environments is necessary for security, no single tool has yet captured the market due to the trade-offs between ease of use, performance, and the "security-utility" tension. Most participants prefer building their own modular stacks—often relying on libvirt, cloud-init, or specialized projects like smolvm—to maintain control over their specific workflow requirements and threat models.