OPEN SOURCE · APACHE 2.0

The microVM sandbox for AI coding agents.

Run Claude Code, Codex and other agents inside an ephemeral microVM on Mac or Linux.

View on GitHub ↗

Free and open source, under Apache 2.0.

Built by NOFire AI

Start in your terminal

01INSTALL BRIG

02RUN YOUR AGENT

Installation guide →
RUNS ON
macOSApple Silicon
Linuxx86_64 · ARM

A REAL SESSION

Claude Code in a sandbox, working on one project.

01 / ISOLATION

Why a microVM?

Coding agents install packages, execute commands and use credentials. With auto-approval, they can do this without stopping to ask.

Brig contains the agent's execution inside a microVM, with its own Linux kernel and a hardware-enforced isolation boundary.

A Docker dev container shares the host's kernel. Docker Sandboxes boots a microVM, from a closed-source tool. Brig boots one under an open-source hypervisor.

Read the security model → Compare Brig with Docker sandboxes →
What a sandbox mounts Two host directories reach the sandbox: the project you name, mounted read-write at /work/demo, and the guest home, mounted as the agent’s home. Other projects, your documents, your keychain and your SSH agent do not. Your machine Sandbox microVM, own kernel ~/code/demo the project you name ~/.brig/homes/<sandbox> guest home ~/code/other-project ~/Documents Keychain SSH agent /work/demo read-write /root the agent’s home: settings and history claude starts in /work/demo Nothing else from your machine is mounted.

02 / NETWORK

You choose where it connects.

A policy names the hosts and ranges the agent can reach. Brig enforces it outside the guest, at a gateway on macOS and in nftables on Linux.

A name you did not allow does not resolve, and an address you did not allow does not connect.

Write a policy →
An egress policy at the gateway The sandbox sends every connection through a network gateway that enforces the policy. Connections to api.anthropic.com and 10.0.0.0/8, which the policy allows, pass. A name the policy does not allow does not resolve, and a connection to an address it does not allow does not open. Sandbox claude every connection goes through the gateway Network gateway enforces your policy default: deny allow: - api.anthropic.com - 10.0.0.0/8 api.anthropic.com allowed 10.0.0.0/8 allowed example.com the name does not resolve 203.0.113.7 the connection does not open

03 / CREDENTIALS

Keys stay on your machine.

With a route, the agent gets a session token in place of the key. The broker on your machine adds the key to each request the route allows, by method, path and git repository.

Any other request is refused before the key is read.

Set up the broker →
A request through the credential broker The agent in the sandbox holds the route URL and a session token, and never the credential. It sends its request to brig.internal. brig-broker on your machine checks the token and the route's request.allow, reads the credential from Brig's secret store, adds it to the request, and sends the request to api.anthropic.com over a TLS connection of its own. The response streams back with the credential redacted. The credential does not reach the sandbox, and the policy refuses a direct connection from the sandbox. Sandbox Your machine api.anthropic.com the route’s upstream egress: default: deny a direct connection the broker’s own TLS claude ANTHROPIC_BASE_URL the route URL CLAUDE_CODE_OAUTH_TOKEN a session token for the route brig.internal brig-broker one per host 1 checks the token 2 checks request.allow 3 adds the credential 4 redacts the reply Brig secret store claude-credentials refreshed on the host and written back the credential stays on the host The agent holds a token for its route, and never the credential.

04 / COMPATIBILITY

Use your usual agent.

Curated profiles, ready to run.

Claude CodeCodex GeminiGrokopencode

Or bring your own environment using OCI images.

Write a profile →

05 / OPEN SOURCE

Apache 2.0.
Brig, hull and hvi.

Free to use, inspect and contribute to.

On macOS, hull boots each sandbox on hvi, a microVMM built for Brig. hvi owns the guest's memory and vCPUs, serves its virtio devices, and confines itself before the guest runs. It is about 15,000 lines of Rust, plus tests.

How it is built → | Browse the source ↗ | Contribute →