TL;DR
Get wellness gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Devvm.dev presents a free, open-source command-line tool that creates an isolated virtual machine for each project, with project-specific toolchains and optional coding agents. Its site says project files are mounted read-write while other home-directory files are excluded, and new VMs use a restricted network tier by default. Availability, platform requirements and independent security testing are not specified in the supplied material.
Devvm.dev is presenting a free, open-source command-line tool that starts a separate virtual machine for each project, with the project’s toolchain and selected coding agents ready inside it. The approach is intended to keep agents and project code away from unrelated files on a developer’s machine, while limiting network access through a configurable proxy and host allowlist, according to the project’s website.
The product’s described workflow begins in a project folder: a developer runs devvm, reviews the proposed VM configuration and confirms or customizes it. The site’s example detects Node and Python from a folder containing package.json and pyproject.toml, and proposes a VM with four CPUs, 8 GiB of memory and an allowlist network tier. The site does not say those example resource settings apply to every project.
Inside the VM, users can run Claude Code, Codex or opencode. Devvm says the project folder is mounted read-write at the same path, while agent skills and settings are available read-only. Other home-directory locations, including the examples ~/.ssh, ~/.aws and ~/Documents, are not mounted. On macOS, the product says it locks Git hooks and configuration; an optional –clone mode uses a separate repository clone rather than the developer’s working tree.
The website also describes built-in Docker, Nix and desktop layers, with a command for creating custom layers. It says ports forward automatically, allowing a development server running inside a VM to be reached through localhost on the host machine, and that devvm code opens the VM in VS Code through Remote-SSH. A first VM builds a base image; later VMs are copies of it and are described as starting in seconds.
Project Isolation for Coding Agents
The product addresses a practical security concern for developers using code and AI agents: software dependencies, malicious instructions, leaked credentials or an agent’s actions can affect files and services accessible to the process. By putting a project in a separate VM and withholding other home-directory folders, devvm aims to limit what those events can reach. That boundary may be useful for people who want to test code or run agents without granting them broad access to their workstation.
Network controls are another part of the offer. Devvm says new VMs use an allowlist tier by default, with traffic routed through a proxy on the developer’s machine; users can instead choose internet, open or no-network tiers. The stated defaults could reduce exposure compared with running an agent directly on a host, but the site itself cautions that no sandbox closes every gap. The real protection depends on the implementation, configuration and remaining attack paths.
The workflow also links isolation to everyday development rather than treating it as a separate setup project. Automatic toolchain detection, port forwarding and editor access are presented as ways to keep familiar project work inside the VM. Whether that convenience is enough to prompt adoption will depend on details such as supported operating systems, resource use and how well the tool fits existing development environments.
Products Worth Considering
Therabody Theragun Mini 3rd Generation Massage Gun, Black
Bowflex SelectTech 840 Adjustable Kettlebell
Hyperice Hypervolt Go 3 Percussion Massage Gun with Carry Case
As an affiliate, we earn on qualifying purchases.
How the Per-Project VM Works
Devvm’s central design is to keep the project folder accessible while leaving the rest of the user’s home directory outside the VM. Its documentation says the folder is mounted read-write, and agent settings from devvm’s own store are mounted read-only. This is different from a setup in which an agent can freely browse the host’s other files, though the project itself remains writable in the standard mode.
For stronger separation from the working tree, the site describes –clone: the VM operates on its own clone, and changes reach the user’s repository only after they are fetched. It also says macOS users get protection for Git hooks and configuration. These features address specific routes between guest and host, but the website’s own security material points readers to separate pages on remaining attack vectors and safer usage habits.
The supplied product information describes a first VM building a base image and subsequent VMs being copied from it. It does not provide a dated launch announcement, a version history or independent performance measurements. Accordingly, the “starts in seconds” wording is a product claim, not an independently verified benchmark.
““One VM for every project””
— Devvm.dev
Security and Platform Details
The supplied information does not specify which operating systems and hardware configurations devvm supports, how it is installed, or whether it is available through a package manager. It also gives no release date, version number, project-maintainer details or independent security audit. Those details would help developers judge compatibility and the maturity of the implementation.
Some security mechanics remain described only at a high level. The site says network traffic goes through a host proxy and an allowlist, but the supplied material does not identify the default allowed hosts, explain how users manage that list, or detail how the proxy handles credentials. It also does not document all VM escape risks or the effect of host and hypervisor vulnerabilities. The project explicitly says some attack vectors remain open, so the described isolation should not be read as a guarantee that a host cannot be affected.
It is also unclear how the tool handles projects that need credentials, private package registries or services beyond the selected network tier, and what limitations apply to each coding agent. The website describes a Claude login flow that keeps credentials on the user’s machine, but the source material does not provide equivalent detail for Codex or opencode. No independent user reports or testing results were included in the material available for this report.
Check Compatibility and Safeguards
Developers interested in the tool can consult devvm.dev and its linked documentation for installation instructions, configuration choices, supported toolchains and the project’s security guidance. Before using it with sensitive repositories, they should verify the host platform, inspect which files are mounted, review the network tier and allowlist, and understand how credentials are stored and exposed to agents.
The next useful evidence will be fuller platform and release details, documentation of network and VM boundaries, and independent testing or user experience reports. Until those are available, devvm’s performance and security claims should be treated as descriptions from the project, not externally verified findings.
Key Questions
What is devvm.dev?
Devvm is a free, open-source command-line tool described as creating a development VM for each project, with selected toolchains and coding agents available inside.
Which coding agents does it support?
The site lists Claude Code, Codex and opencode. Users can select agents when customizing a new VM or configure agents for new VMs through devvm setup.
Can a devvm access files outside the project?
According to the site, the project folder is mounted read-write, while other home-directory locations such as SSH keys, AWS files and Documents are not mounted. Agent settings from devvm’s store are mounted read-only. The optional –clone mode keeps work in a separate repository clone.
Does devvm guarantee that a coding agent cannot affect the host?
No such guarantee is established in the supplied material. Devvm says its sandbox is intended to limit an attack’s reach, but also states that no sandbox closes every gap. Independent security testing was not provided.
What operating systems can run devvm?
The supplied information mentions a specific Git-protection feature on macOS, but does not give a full list of supported operating systems or hardware requirements. Check the project documentation for current compatibility details.
Source: devvm.dev
