TL;DR
Get business pricing on networking and server gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Devvm.dev describes a free, open-source tool that creates an isolated virtual machine for a project, with its detected toolchain and selected coding agent ready to use. The project says the VM mounts the project folder, keeps other home-directory files outside it and routes network access through a configurable proxy; independent security testing and several implementation details are not provided in the source material.
Devvm.dev has introduced a free, open-source command-line tool designed to launch a separate virtual machine for each software project, with the project’s detected toolchain and a selected coding agent available inside. The approach aims to keep agents and project code apart from personal files and credentials on a developer’s machine, while limiting the VM’s network access by default.
To use the tool, developers open a terminal in a project folder and run devvm. The site says the command examines project files to select toolchains: a folder containing both package.json and pyproject.toml, for example, gets Node.js and Python. Before creating a VM, it displays its proposed configuration, including toolchain, agent, machine size and network tier. Users can accept or customize those choices. The example configuration shown on the site is four CPUs and 8 GiB of memory; the site does not say that this is the only available size.
Inside the VM, users can run Claude Code, Codex or opencode. The project says the VM mounts the project directory read-write at the same path, while agent skills and settings are available read-only from devvm’s store. Other home-directory locations, such as SSH keys, cloud credentials and Documents, are not mounted in the example. A first VM builds a base image, and later VMs are copies of it that the site says start in seconds.
Network traffic from the VM passes through a proxy on the developer’s machine. Devvm says new VMs default to an allowlist tier, which restricts connections to permitted hosts; users can choose internet or open access, or a stricter no-network tier. The site also describes automatic port forwarding, VS Code access through Remote-SSH, optional Docker, Nix and desktop layers, and a –clone option that has the VM work on a separate repository clone rather than the developer’s working tree.
Project Isolation for Coding Agents
The announcement addresses a practical security concern for developers using automated coding tools: an agent can read and modify files available to its environment, and may run project code or interact with network services. A separate VM can limit the files and services exposed to that work compared with running an agent directly in a regular desktop session. Devvm’s stated design keeps the project in the VM but excludes other home-directory data by default.
That boundary matters because development environments often contain sensitive credentials, unrelated repositories and personal files. A controlled network tier may also reduce exposure to hosts that are not needed for a task. These are design goals described by the project, not evidence that the tool prevents every attack. The website itself says no sandbox closes every gap and points users to material on remaining attack paths and safer practices.
For teams and individual developers, the appeal is the promise of turning isolation into a repeatable workflow rather than a collection of manual setup steps. The site’s claims about quick startup, automatic tool detection and ready-to-use agents could reduce friction, but actual setup time, compatibility and security depend on the user’s machine, project and configuration. The announcement provides no independent benchmarks or security audit results.
Products Worth Considering
Apple MacBook Air 13-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Liquid Retina Display, and Touch ID – Midnight
Kindle Paperwhite Signature Edition 32GB (2024) – Auto-adjusting front light, wireless charging, weeks of battery life – Metallic Black
Samsung Galaxy Tab A11 8.7-Inch Wi-Fi Tablet, 64GB, 4GB RAM, Silver
As an affiliate, we earn on qualifying purchases.
How the VM Workflow Is Set Up
Devvm’s described workflow begins in an existing project directory. It proposes a VM configuration based on files in that folder, then opens a shell marked with a (devvm) prompt. The user starts an agent from inside that shell. The site says the same VM is reopened on later runs, while a separate command can add an agent to an existing VM.
The product combines several familiar development tools and isolation choices. It offers built-in Docker, Nix and desktop layers, with custom layers available through a command. Optional shell utilities include fzf and zoxide. Git name and email are passed into each VM so commits are attributed to the developer, and ports such as a development server on 5173 can be forwarded to localhost on the host machine.
Devvm also describes protections for repository metadata on macOS: it says the VM locks Git hooks and configuration so the guest cannot change what Git runs on the host. With the clone option, changes are made to a separate clone and must be fetched back to the developer’s repository. These details are part of the project’s published description; the source material does not include a third-party review of how these protections work across supported systems.
“One VM for every project”
— Devvm.dev
Security and Compatibility Still Need Testing
The published description does not provide a release date, supported operating-system list, installation requirements, license text or source-code repository. It also does not specify the full set of network allowlisted hosts, how users review or change that list, or the technical details of how the host proxy handles credentials and traffic. The exact VM technology, cloud or local execution model, and resource limits beyond the example configuration are not established in the supplied material.
Security statements, including the claims about excluded home-directory files and locked Git metadata, are descriptions from the project rather than independently verified findings. The source provides no audit, penetration-test results or comparative measurements of startup time. It is also unclear how the tool handles secrets intentionally placed inside a project folder, malicious project dependencies, or agent credentials after login. Those questions affect how much protection the boundary offers in real use.
Installation and Security Details to Watch
The site directs readers to its installation instructions and documentation, where developers can check prerequisites, configure toolchains and agents, and review the available network and isolation options. Further details about supported platforms, the project’s code and licensing would help readers assess whether devvm fits their setup; those details are not included in the source material provided here.
For prospective users, the next practical step is to test the tool with a non-sensitive project and verify what the VM can access, which network hosts it can reach, and how changes return to the working repository. Independent security review and documented limits would provide a clearer basis for judging the project’s protections. Until then, devvm’s isolation and convenience features should be treated as claims made by the project, not guarantees against compromise.
Key Questions
What is devvm.dev?
Devvm is a free, open-source tool described by its website as creating a separate VM for each development project, with the project’s toolchain and a chosen coding agent available inside.
Which coding agents does it support?
The site lists Claude Code, Codex and opencode. Users can choose an agent when customizing a new VM or set agents for future VMs through devvm setup.
What files can the VM access?
According to the project, the VM mounts the selected project folder read-write and does not mount other home-directory locations such as SSH keys, cloud credentials or Documents in the example. Agent settings are described as read-only. The source does not provide an independent verification of these access boundaries.
Does devvm block all network access?
No. New VMs reportedly use an allowlist network tier by default, but users can choose internet or open access, or select a no-network tier. The project says traffic passes through a proxy on the host machine.
Has devvm’s security been independently verified?
The provided source material includes no independent audit or security test results. The site says no sandbox closes every gap, so its protection claims should be distinguished from externally verified findings.
Source: devvm.dev
