isolate

isolate is a native Swift reimplementation of coop from Trail of Bits, for running Claude Code and Codex in disposable Linux VMs on macOS 27+ Apple Silicon. It replaces the Rust host and credential proxy with Swift and uses a purpose-built runtime on Apple Containerization. Focusing on one host platform and removing the former Rust networking and TLS dependency tree reduces what needs maintenance and security review. The aim is a smaller attack surface; Swift alone does not guarantee fewer vulnerabilities or complete isolation.

Agents get full tool access inside the VM: Docker, git, compilers and package managers. The VM is the isolation boundary. A host credential proxy can keep provider API keys out of the guest.

Setup

Install the latest release. The installer verifies the release's signed SHA256SUMS and, when gh is installed, its build attestation:

curl -fsSL https://raw.githubusercontent.com/chr33s/iso/main/install.sh | bash

It installs all five executables into one directory on PATH: iso, iso-proxy, iso-egress, iso-sandbox and iso-macos-helper, with the Linux desktop images' guest files iso-cu-mcp and vmlinux-desktop. To build from source instead, with Xcode 27:

git clone https://github.com/chr33s/iso.git
cd iso
python3 scripts/build-release.py --release

and install the same five executables from the archive in .build/release-archive/ into one directory on PATH. See prerequisites, build instructions and Apple backend setup.

Create the configuration and build the VM template:

iso setup

Configuration lives in ~/.iso/config.jsonc; state lives under ~/.iso. Use iso setup --config-only to write just the commented configuration template. iso update installs newer releases.

Usage

Start a VM for your project, then launch an agent:

cd ~/code/my-project
iso up
iso claude
# or
iso codex

Open the project's VM in an editor (creating or starting it first, like iso up). The editor runs as a new, sandboxed instance that cannot reach your files, keychain or clipboard; see editor integration:

iso code .
iso zed .

macOS guests

Build a macOS image from an Apple restore image you supply, then start an instance with at least the restore image’s required CPU and memory (typically 4 vCPUs and 8192 MiB); see macOS guests:

iso setup --guest macos --ipsw ~/Downloads/UniversalMac_27.0.1_Restore.ipsw --image mac
iso up . --image mac --vcpus 4 --mem 8192

To let an agent in a macOS guest see and drive its own display, set "computer_use": {"guest_access": true} before creating the instance. The agent gets an iso-cu MCP server; the host injects its input through the VM's virtual keyboard and pointer and can take the display back at any time. See computer_use. Linux images built with the desktop profile get the same display, input and iso-cu server; see Linux desktop images.

Remote Macs

Enroll another trusted Apple Silicon Mac over SSH and run a project's VM there. --agent-path is where iso is installed on that Mac (~/.local/bin/iso with the installer); see iso host:

iso host add build-mac --ssh build-mac --agent-path /Users/me/.local/bin/iso
iso host up build-mac .

Security controls

Default VMs are hardened. Without a preset, iso applies provider-only: a NIC-less brokered VM with no general egress, the credential proxy required, and staged file returns. Each relaxation is explicit, and iso policy effective lists them.

• Security presets: networked (needs "network": {"transport": "vmnet"}) restores open egress and direct pulls; offline suits local models or pre-provisioned images.
• Credential handling: the default proxy.mode: "required" withholds all provider credential variables from the guest.
• Network limits: a brokered VM has no network device; "egress": "filtered" allows only listed hosts. On a vmnet VM, guests can still reach services on the Mac.
• Secret storage: iso secrets encrypts local secrets with a passphrase and this Mac's Secure Enclave key, with no recovery path.
• File review: iso diff or iso pull --review stages guest files for inspection before you apply or discard them.
• Session limits: "limits": {"session_ttl": "8h"} stops each boot at a host-clock deadline.
• Authorization policy: an optional default-deny policy permits provider credential use, proxied requests and iso pull --apply, with request rate limits and a single-use approval of the reviewed stage. iso policy show reports the active snapshot. iso policy effective lists saved grants, which security.revoked_grant_ids revokes.
• Audit records: iso audit reports boundary events and a per-run history (also as a JSONL stream), as metadata only, never values.
• Confined companions: iso-proxy and iso-egress run under a Seatbelt profile that denies home directories, iso state and every loopback service, and release builds start them only with iso's own Developer ID signature.

Read the trust model for the boundaries and their limits.

Documentation

• Getting started, commands and configuration
• Machine interface for editors, CI and other integrations
• iso-ci, the separately installed GitHub Actions companion, which can also gate commits or pushes on your project's workflow from its Git hooks
• Full documentation index
• Architecture and release validation
• Contributing and security policy
• Attribution: NOTICE, provenance and third-party licenses