isolate

isolate is a native Swift reimplementation of
coop from Trail of Bits, for running
Claude Code and Codex in disposable Linux VMs on macOS 27+ Apple Silicon. It
replaces the Rust host and credential proxy with Swift and uses a purpose-built
runtime on Apple Containerization. Focusing on one host platform and removing
the former Rust networking and TLS dependency tree reduces what needs
maintenance and security review. The aim is a smaller attack surface; Swift
alone does not guarantee fewer vulnerabilities or complete isolation.

Agents get full tool access inside the VM: Docker, git, compilers and package
managers. The VM is the isolation boundary. A host credential proxy can keep
provider API keys out of the guest.

Setup

Install the latest release. The installer verifies the release's signed
SHA256SUMS and, when gh is installed, its build attestation:

curl -fsSL https://raw.githubusercontent.com/chr33s/iso/main/install.sh | bash

It installs all five executables into one directory on PATH: iso,
iso-proxy, iso-egress, iso-sandbox and iso-macos-helper, with the Linux
desktop images' guest files iso-cu-mcp and vmlinux-desktop. To build from
source instead, with Xcode 27:

git clone https://github.com/chr33s/iso.git
cd iso
python3 scripts/build-release.py --release

and install the same five executables from the archive in
.build/release-archive/ into one directory on PATH. See
prerequisites,
build instructions and
Apple backend setup.

Create the configuration and build the VM template:

iso setup

Configuration lives in ~/.iso/config.jsonc; state lives under ~/.iso.
Use iso setup --config-only to write just the commented configuration template.
iso update installs newer releases.

Usage

Start a VM for your project, then launch an agent:

cd ~/code/my-project
iso up
iso claude
# or
iso codex

Open the project's VM in an editor (creating or starting it first, like
iso up). The editor runs as a new, sandboxed instance that cannot reach your
files, keychain or clipboard; see editor integration:

iso code .
iso zed .

macOS guests

Build a macOS image from an Apple restore image you supply, then start an instance
with at least the restore image’s required CPU and memory (typically 4 vCPUs
and 8192 MiB); see macOS guests:

iso setup --guest macos --ipsw ~/Downloads/UniversalMac_27.0.1_Restore.ipsw --image mac
iso up . --image mac --vcpus 4 --mem 8192

To let an agent in a macOS guest see and drive its own display, set
"computer_use": {"guest_access": true} before creating the instance. The
agent gets an iso-cu MCP server; the host injects its input through the VM's
virtual keyboard and pointer and can take the display back at any time. See
computer_use. Linux images built with the
desktop profile get the same display, input and iso-cu server; see
Linux desktop images.

Remote Macs

Enroll another trusted Apple Silicon Mac over SSH and run a project's VM there.
--agent-path is where iso is installed on that Mac (~/.local/bin/iso with
the installer); see iso host:

iso host add build-mac --ssh build-mac --agent-path /Users/me/.local/bin/iso
iso host up build-mac .

Security controls

Default VMs are hardened. Without a preset, iso applies provider-only: a
NIC-less brokered VM with no general egress, the
credential proxy required, and staged file returns.
Each relaxation is explicit, and iso policy effective lists them.

• Security presets: networked
  (needs "network": {"transport": "vmnet"}) restores open egress and direct
  pulls; offline suits local models or pre-provisioned images.
• Credential handling: the default
  proxy.mode: "required" withholds all provider credential variables from the
  guest.
• Network limits: a brokered VM has no network
  device; "egress": "filtered" allows only listed hosts. On a vmnet VM,
  guests can still reach services on the Mac.
• Secret storage: iso secrets encrypts local secrets
  with a passphrase and this Mac's Secure Enclave key, with no recovery path.
• File review: iso diff or iso pull --review
  stages guest files for inspection before you apply or discard them.
• Session limits:
  "limits": {"session_ttl": "8h"} stops each boot at a host-clock deadline.
• Authorization policy: an optional default-deny policy
  permits provider credential use, proxied requests and iso pull --apply, with
  request rate limits and a single-use approval of the reviewed stage.
  iso policy show reports the active snapshot. iso policy effective lists
  saved grants, which security.revoked_grant_ids revokes.
• Audit records: iso audit reports boundary events and a
  per-run history (also as a JSONL stream), as metadata only, never values.
• Confined companions:
  iso-proxy and iso-egress run under a Seatbelt profile that denies home
  directories, iso state and every loopback service, and release builds start
  them only with iso's own Developer ID signature.

Read the trust model for the boundaries and their limits.

Documentation

• Getting started, commands and
  configuration
• Machine interface for editors, CI and other
  integrations
• iso-ci, the separately installed GitHub Actions companion,
  which can also gate commits or pushes on your project's workflow from its
  Git hooks
• Full documentation index
• Architecture and release validation
• Contributing and security policy
• Attribution: NOTICE, provenance and
  third-party licenses