Since everyone is sharing their setup, here’s my approach, just to give people an idea of how others are doing it, however impractical it might look: I run a full Linux VM (with a GUI) on my Linux host. I connect via virt-viewer to run Claude Desktop, as I’m not a fan of using the terminal for this.
The VM sits on its own libvirt network in a dedicated firewall zone, and specific directories are shared via filesystem passthrough. To keep the agent from accessing anything related to Git, the actual gitdir is stored on a separate path outside the mount point.
I review the git diff manually and commit it from the host.
Do you find the permanence of a full VM useful? I’ve wondered about something like this but always defaulted to Docker for much the same reasons people use stuff like Ansible. I’m afraid the LLM will heavily customize its environment and I’ll be unable to replicate it when my laptop dies or I can’t upgrade the OS or whatever.
Then again, I guess GUI is a pain in Docker. I tend to operate through Zed and an ACP harness though, so my GUIs are sort of “inside the container” anyways.
My understanding is that the OP is not running any heavy tools/chains inside the sandbox? I use a similar setup, but using Incus and cli agents which I drive via ssh. I make sure I can (and do) rebuild the VM from scratch after every session or so.
Currently considering using ACP for codex so that I can do more of the driving from my editor (emacs, over ssh) and something similar for claude code (it doesn't seem to be as good as codex at supporting re-attachable sessions).
One concern is making sure my editor's ACP client doesn't enable/support fancy terminal stuff, because that would basically void all the benefits of using a VM sandbox.
> I’m afraid the LLM will heavily customize its environment and I’ll be unable to replicate it
Would suggest Hashicorp Packer or cloud-init for deterministic images, not hard to setup or use. LLM's have little problem with them either I find.
If you need quicker environment rebuilds consider using something smaller like alpine as the base, though once you setup a golden image even heavy things like debian are fine.
The VM is allocated 2 cores and 4GB of RAM. For my workload, it doesn't feel any slower than running it directly on the host. The few times I've checked memory usage, it wasn't anywhere near full as far as I remember.
The VM sits on its own libvirt network in a dedicated firewall zone, and specific directories are shared via filesystem passthrough. To keep the agent from accessing anything related to Git, the actual gitdir is stored on a separate path outside the mount point.
I review the git diff manually and commit it from the host.