llm-jail
A Nix script that runs coding agents such as Claude Code, Codex CLI and GitHub Copilot CLI inside hardware-isolated QEMU microVMs, so their dangerous auto-approve flags cannot touch the rest of the host.
llm-jail boots a minimal NixOS guest on tmpfs for each session, sharing the host's Nix store read-only, so a coding agent run with a flag such as Claude Code's dangerously-skip-permissions or Codex's dangerously-bypass-approvals-and-sandbox is contained by a hardware-level hypervisor boundary rather than a container. It wraps several tools, including Claude Code, Codex CLI, GitHub Copilot CLI, opencode, Autolith and Pi, each with its own runner command, plus an interactive shell for debugging.
No host-side credentials are shared into the guest: each tool logs in once inside the jail on first run through its normal OAuth flow, and its state then persists in a jail-private directory under the host's config folder, separate from the user's real credential directories. It requires Linux with Nix flakes enabled, and works best with KVM access, falling back to emulation without it.