Display Name
Code on Incus (coi) Sandbox
Category
Tooling
Sub-Category
Tooling: Orchestrators
Primary Link
https://github.com/mensfeld/code-on-incus
Author Name
Maciej Mensfeld
Author Link
https://github.com/mensfeld
License
MIT
Other License
No response
Description
A CLI tool that runs Claude Code and other AI coding assistants inside isolated Incus system containers, providing automatic UID mapping, credential protection, multi-slot parallel session support, and an optional security monitoring daemon with real-time detection of reverse shells, data exfiltration attempts, and credential scanning.
Validate Claims
Video demo: https://www.youtube.com/watch?v=t78-JUnTK5Q (made by BetterStack, not me)
You can also install coi via the one-liner in the README, run coi build to build the base image, then run coi shell --monitor from any project directory.
To validate isolation: inside the container, run cat ~/.ssh/id_rsa and echo $SSH_AUTH_SOCK - both should return nothing, confirming host credentials are not exposed.
To validate file ownership: create a file inside the container at /workspace/test.txt and confirm it appears on the host owned by your user, not root.
To uninstall coi you just need to remove its binary.
Specific Task(s)
You can run coi shell and in Claude Code ask it to:
Tell me something about the environment in which you operate?
The expected outcome (may vary a little ofc) is:
I'm running inside a Code on Incus (COI) sandbox container — an ephemeral, disposable Ubuntu (amd64) environment built for AI coding tasks.
Key highlights:
- Workspace: /workspace (a git repo on the feat/build-config-coi-dir branch)
- Full root access via passwordless sudo
- Docker-in-Docker available
- Runtime management via mise (Python 3, Node.js, pnpm, TypeScript/tsx pre-installed)
- Rich tooling: git, curl, jq, ripgrep, fd, fzf, imagemagick, sqlite3, and many more pre-installed
- Network: internet access allowed, but local/private networks are blocked by firewall
- Ephemeral: the container is destroyed after the session ends — only changes in /workspace persist to the host
Essentially, it's a throwaway sandbox where I can freely install packages, build software, run containers, and modify system settings without worry.
Specific Prompt(s)
As described above in the "Specific Task(s)" section - you can run coi shell and ask it to explain where it runs. Claude will understand the scope of operations and where it is.
You can also ask it to describe the scope of permissions and how it sees itself:
can you operate freely with the bypass permissions on? what can you do here?
Example output:
Yes, with bypass permissions on, all my tool calls execute without prompting you for approval each time. Here's what that means practically:
File Operations — Read, write, edit, and create any files in the workspace (or anywhere in the container)
Shell Execution — Run any bash commands: build, test, install packages, manage services, use git, docker, etc.
Search & Explore — Glob, grep, and navigate the entire codebase freely
Web Access — Fetch URLs and search the web for documentation/references
Agents — Spawn sub-agents for parallel research, exploration, or isolated work in git worktrees
Since this is a COI sandbox, I also have:
- sudo access for system-level changes
- Docker for building/running containers
- mise for installing any language runtime
- Full internet access (except local/private networks)
The only things I'll still pause on are irreversible or shared-state actions (like force-pushing, deleting branches, or posting to external services) — I'll confirm those with you first per best practice, not because of
permissions.
Additional Comments
I built this because I see agentic coding differently from the mainstream "one Claude Code that does everything" approach.
My mental model is a fleet of isolated VMs, each playing a distinct role - some ephemeral, some persistent - that can spawn and manage their own containers, operate in parallel without interfering with each other, and be discarded when no longer needed.
The other thing I care deeply about is supply chain security. When an AI tool is writing and executing code autonomously, the blast radius of a compromised dependency or a malicious prompt should be near zero. COI is designed so that the only thing that ever leaves the container and touches your host is the files you choose to inspect - no git hooks, no VS Code tasks, no credential leakage, no host network access. The artefacts are the output; everything else stays contained and can be audited before it ever runs on your machine.
The install script is included in the repo with inline comments; a full manual installation path is also documented in the README. Network requests can be limited to the Anthropic API and standard package registries during image build.
Linux only (x86_64 and arm64); macOS/Colima is partially supported, but nftables monitoring is unavailable on that platform.
Recommendation Checklist
Display Name
Code on Incus (coi) Sandbox
Category
Tooling
Sub-Category
Tooling: Orchestrators
Primary Link
https://github.com/mensfeld/code-on-incus
Author Name
Maciej Mensfeld
Author Link
https://github.com/mensfeld
License
MIT
Other License
No response
Description
A CLI tool that runs Claude Code and other AI coding assistants inside isolated Incus system containers, providing automatic UID mapping, credential protection, multi-slot parallel session support, and an optional security monitoring daemon with real-time detection of reverse shells, data exfiltration attempts, and credential scanning.
Validate Claims
Video demo: https://www.youtube.com/watch?v=t78-JUnTK5Q (made by BetterStack, not me)
You can also install
coivia the one-liner in the README, runcoi buildto build the base image, then runcoi shell --monitorfrom any project directory.To validate isolation: inside the container, run
cat ~/.ssh/id_rsaandecho $SSH_AUTH_SOCK- both should return nothing, confirming host credentials are not exposed.To validate file ownership: create a file inside the container at
/workspace/test.txtand confirm it appears on the host owned by your user, not root.To uninstall coi you just need to remove its binary.
Specific Task(s)
You can run
coi shelland in Claude Code ask it to:Tell me something about the environment in which you operate?The expected outcome (may vary a little ofc) is:
Specific Prompt(s)
As described above in the "Specific Task(s)" section - you can run
coi shelland ask it to explain where it runs. Claude will understand the scope of operations and where it is.You can also ask it to describe the scope of permissions and how it sees itself:
Example output:
Additional Comments
I built this because I see agentic coding differently from the mainstream "one Claude Code that does everything" approach.
My mental model is a fleet of isolated VMs, each playing a distinct role - some ephemeral, some persistent - that can spawn and manage their own containers, operate in parallel without interfering with each other, and be discarded when no longer needed.
The other thing I care deeply about is supply chain security. When an AI tool is writing and executing code autonomously, the blast radius of a compromised dependency or a malicious prompt should be near zero. COI is designed so that the only thing that ever leaves the container and touches your host is the files you choose to inspect - no git hooks, no VS Code tasks, no credential leakage, no host network access. The artefacts are the output; everything else stays contained and can be audited before it ever runs on your machine.
The install script is included in the repo with inline comments; a full manual installation path is also documented in the README. Network requests can be limited to the Anthropic API and standard package registries during image build.
Linux only (x86_64 and arm64); macOS/Colima is partially supported, but nftables monitoring is unavailable on that platform.
Recommendation Checklist