[cdata]

If you are a Nix flake enjoyer, I whipped up something similar to this (Claude Code-only right now) based on microvm.nix: https://github.com/cdata/katsuobushi/tree/main/lib/sandbox

Some highlights:

- Drives Claude Code as a quasi-subagent via "Channels," which supports multi-turn interaction with the host and suspend / resume

- Declarative configuration in the flake of exactly what is copied into the VM (besides the local project), what DNS origins are allowed, etc.

- Shared access to host Nix store / object DB via overlay FS

- Syncs code with the host over a shared (local) Git remote (no worktree mess to manage)

- Devshell commands for quickly dropping into the guest and viewing status of all VMs etc.

- VMs start in a couple of seconds

[riedel]

Nice I started to vibecode something with bwrap.nix: https://github.com/riedel/nix-opencode-with-mitm (not anywhere near production ready) What I would really want is token injection outside the sandbox and good control over the network, why I tried integrating a mitm proxy outside the sandbox.

[mkagenius]

If you are into nixos, we at InstaVM have just launched[1] nixos based sandboxes.

1. https://instavm.io/blog/nixos-reproducible-dev-environments-...

[cdata]

That's very cool, although AFAICT my hacked-together non-product shares most of the same virtues. Can you upsell it to me a little?

[mkagenius]

Our nixos sandboxes are mostly a cloud offering at this time. Scale is what we can offer additionally. Have secret injection built in too. I see you have suspend, resume we have the same. We have snapshots and cloning. Startup time is sub second with warm pools - which will go further down when we replace firecracker with Tarit soon.

1. Tarit - https://GitHub.com/instavm/tarit