Product overview
DevVM gives each project a reusable Linux virtual machine. You enter a project folder on the host, run devvm and start the coding agent inside the VM shell. The project files determine suggested toolchains, while customization can add more tools or image layers. Running it again in the same folder reopens that project's VM instead of creating an unrelated environment each time.
The important boundary is what the VM can reach. The default workflow mounts the project read-write, exposes agent skills read-only and copies supported settings, while unrelated home folders and agent history stay outside. A host-side proxy supplies actual agent credentials to outbound requests instead of putting them directly into the VM. These are the publisher's documented mechanisms, not a claim that every possible attack is prevented.
A writable project mount can still be changed by the agent. For a separate working copy, the documented clone mode keeps changes in the VM's own repository until you fetch them. Network tiers range from no access to looser access, with an allowlist default for new VMs. Review mounts, network choices and the host-specific limits together: macOS .git protection is not available on every Linux host.
What devvm offers
- 01Reuse one VM per project with toolchains selected from project files.
- 02Run supported Claude Code, Codex or opencode agents inside the VM.
- 03Configure network tiers and host-proxied agent credentials.
- 04Use optional layers, port forwarding and VS Code Remote-SSH integration.
- 05Choose clone mode when the VM should not write directly into the host working tree.
A practical workflow
- 01Check Lima and the host prerequisites; Linux additionally needs QEMU and access to /dev/kvm.
- 02Enter the intended project folder and review the proposed tools, agent, resources and network tier before creating the VM.
- 03Start the agent from the VM shell and complete its documented provider login if required.
- 04Confirm which project paths are writable, which skills/settings are exposed and which network destinations are permitted.
- 05Review the actual diff and outputs; use clone mode when you want to fetch changes explicitly rather than share the working tree.
Summary based on source material; product claims have not been independently tested.
What makes it different
It combines project-oriented VM lifecycle with development toolchains and agent-specific credential handling. The default writable project is a deliberate access grant; the VM boundary should not be confused with a guarantee that project files cannot change. Evaluate it against the exact mounts and network policy you select.
Who should consider it
- Developers who want coding agents to run in a project-scoped environment.
- Teams maintaining different toolchains across local projects.
- Users willing to review filesystem and network access rather than rely on a blanket sandbox promise.
What to verify
- Requires macOS 13+ or Linux on arm64/x86_64 and Lima 2.2+. The repository reports testing on Apple Silicon Macs and Linux; Intel Macs are not yet tested.
- A read-write project mount permits edits to that project; protect or clone the work accordingly.
- Check host-specific .git protection and the remaining attack vectors documented by the project.
- The MIT tool license does not make external model subscriptions or computing resources free.
Frequently asked questions
Does the coding agent run on the host?
In the documented workflow you start it inside the VM shell, so it runs in the VM. You still need to verify that you launched it there rather than in a separate host terminal.
Can an agent still change my project?
Yes. The default project folder is mounted read-write. The documented --clone mode works on a separate repository copy and brings changes back only when you fetch them.
What extra setup does Linux need?
The official page lists Lima, QEMU and access to /dev/kvm. Linux also has documented host-specific limits, including missing .git protection; check current installation and safety documentation.
Explore related tasks
Product facts were checked against the official product website or its first-party documentation on Nov 7, 2026.
