TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Devvm.dev describes a free, open-source tool that creates a virtual machine for a project with its detected toolchain and selected coding agents. The project folder is mounted read-write, while other home-directory files are excluded; network access defaults to an allowlist routed through a local proxy. The site does not provide independent security testing or enough technical detail to verify how the protections perform in practice.
Devvm.dev is presenting a free, open-source command-line tool that creates a separate virtual machine for each project, with project development tools and coding agents available inside it. The tool is designed to keep the project and agent activity inside the VM while leaving other home-directory files outside, an approach intended to limit exposure from risky code or agent behavior.
According to the project’s website, a developer runs devvm from a project directory. The tool examines project files to select toolchains; its example says a folder containing both package.json and pyproject.toml receives Node.js and Python. Before creating the VM, devvm displays its proposed tools, agent, size and network tier and asks the user to confirm or customize the setup. The example configuration lists four CPUs and 8 GiB of memory, but the site does not say that these are mandatory settings for every VM.
The site says the project directory is mounted read-write at the same path inside the VM. Other home-directory locations, including SSH keys, cloud credentials and Documents, are not mounted. Claude Code, Codex and opencode are listed as supported coding agents. Agent settings are made available from devvm’s own store as read-only, while the site says a Claude login can be initiated from the VM and kept on the developer’s machine. It also describes port forwarding, opening a VM in VS Code over Remote-SSH, and assigning the developer’s Git name and email to commits.
For networking, new VMs use an allowlist tier by default, according to the site. Traffic passes through a proxy on the developer’s machine, and users can choose other tiers, including internet, open or none. On macOS, the project says devvm locks Git hooks and configuration to prevent the VM from changing what Git runs on the host. An optional clone mode gives the VM a separate repository copy, with work returned by fetching changes. These are product descriptions from the project, not independent test results.
A Separate Boundary for Each Project
The announcement addresses a practical security problem for developers using third-party code and coding agents: those tools can interact with files and services available in their environment. A project-specific VM can give developers a way to run that work without automatically exposing the rest of their home directory. If the isolation behaves as described, a compromised project or agent would have fewer direct paths to SSH keys, cloud credentials and other projects.
The pitch also focuses on reducing setup work. Virtual machines, agent configuration and network restrictions can require separate choices and maintenance. Devvm says it supplies defaults and launches from a project directory, while allowing users to adjust the VM’s tools and access. That may make sandboxing easier to try, but it does not establish that the defaults suit every workflow or threat model. Users still need to understand what the VM can access, particularly when they loosen the network tier or add custom layers.
The tool’s limits matter as much as its boundary. The project itself warns that no sandbox closes every gap and publishes separate material on remaining attack paths and safe practices. The announcement should therefore be read as a description of a development environment, not a guarantee that malicious code or agents cannot affect a host machine.
Products Worth Considering
Apple MacBook Air 13-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Liquid Retina Display, and Touch ID – Midnight
Samsung Galaxy Tab A7 Lite 8.7-Inch 32GB Wi-Fi Tablet, Gray
Samsung Galaxy Tab A11 8.7-Inch Wi-Fi Tablet, 64GB, 4GB RAM, Silver
As an affiliate, we earn on qualifying purchases.
How the Project VM Works
Devvm presents its workflow as a short sequence: enter a project folder, run the command, review the proposed VM and start a shell inside it. The shell prompt is marked “(devvm)” to distinguish it from the host. Running an agent then happens inside that VM. The site says the first VM builds a base image and later VMs are copies that start in seconds; it does not provide measured startup times or benchmark results.
The listed environment can include built-in Docker, Nix and desktop layers, as well as custom layers created by users. Optional command-line conveniences include tools such as fzf and zoxide. The site says a project can reuse its VM on later runs and that users can add an agent to an existing VM. These details position devvm as both a sandbox and a way to keep project-specific tools together.
The site’s security model is based on separation and controlled access rather than a claim that all risks are eliminated. It describes the project folder as writable inside the VM, selected agent settings as read-only, and other home files as excluded. Network access is routed through a host-side proxy, with the default allowlist intended to restrict which destinations the VM can reach. On macOS, Git protections and clone mode offer additional separation for repository operations, according to the project.
“One VM for every project”
— Devvm.dev
Security Claims Need Validation
The supplied product material does not identify an independent security review, external testing results or a detailed threat model. It also does not specify the operating-system and hardware requirements, exact VM technology, or how the host-side proxy handles credentials and failures. Those details would help developers judge whether the isolation fits their systems and projects.
Other practical questions remain open in the material: how users configure or audit the network allowlist, how updates to base images and toolchains are handled, and what protections apply beyond the stated macOS Git safeguards. The site acknowledges remaining attack vectors, but the supplied text does not enumerate them. Its descriptions of isolation and reduced exposure should be treated as claims by the project until supported by technical documentation or independent evaluation.
Documentation and Testing to Watch
The next useful steps for prospective users are to review devvm’s installation guide, supported platforms, toolchain and agent documentation, and its published notes on remaining attack paths. Developers considering the tool for sensitive repositories will also need to check how its VM and proxy behave in their own environment, and whether the default network allowlist permits the services their project requires.
The supplied announcement does not give a release schedule, adoption figures or a roadmap. Further clarity would come from project documentation explaining the implementation and update process, along with independent testing of the isolation boundaries. Until then, the confirmed development is the availability of a described open-source workflow—not verified proof that every stated protection holds against every attack.
Key Questions
What is devvm.dev?
Devvm is a free, open-source command-line tool described by its website. It creates a virtual machine for a project and makes selected development tools and coding agents available inside it.
What files can the VM access?
According to the project, the project folder is mounted read-write, while other home-directory locations such as SSH keys, cloud credentials and Documents are not mounted. Agent settings from devvm’s store are described as read-only.
Which coding agents are supported?
The site lists Claude Code, Codex and opencode. Users can select an agent when customizing a new VM or set agents for new VMs through devvm setup.
Does devvm prevent all security risks?
No such guarantee is made in the supplied material. Devvm says a sandbox limits an attack’s reach but also warns that no sandbox closes every gap; independent security testing is not described.
How does network access work?
New VMs use an allowlist network tier by default, according to the site. A proxy on the developer’s machine routes traffic, and users can choose other listed tiers, including internet, open or none.
Source: devvm.dev
