trivo25/code-airlock

Code Airlock is a shell tool that runs AI coding agents (such as Claude Code, Codex, or OpenCode) inside a disposable microVM so they cannot touch your actual codebase while working. The agent gets full freedom to install packages, run tests, read logs, and iterate inside a sandboxed copy of your project. Your host repo stays read-only the entire time. When the agent is done, its changes come back as ordinary git commits that you review and merge only when satisfied. The core safety model is straightforward. Docker Sandboxes (a Docker product) creates a private clone of your repo inside a virtual machine. The agent commits its edits to that clone, not to your working copy. You then run fetch, diff, and merge commands from your host machine to inspect what the agent did before anything lands in your real repository. If the agent makes a mess, you discard the sandbox and start over. The reason this is useful is that AI coding agents work best when they can act without asking for permission at every step. Run a test, see it fail, install a missing dependency, re-run, iterate. Restricting every individual shell command degrades the agent into a slow helper. Code Airlock moves the main boundary below the agent rather than inside it, letting the agent work more freely inside a disposable environment while the review gate stays on your side. Setup involves installing Docker Sandboxes separately (the tool that provides the microVM layer), then installing code-airlock via npm or a shell installer. A doctor command checks that all prerequisites are in place before you launch anything. From inside your project folder, one command starts the agent in a sandbox, another lets you review its commits, and a final merge brings accepted changes home. The tool also supports running agents over SSH with tmux so you can disconnect and reconnect without stopping the session. Network access inside the sandbox can be restricted to an allowlist of approved domains, such as model APIs and package registries, if you want an additional layer of containment.