Code Airlock

Code Airlock lets you give coding agents like Claude Code, Codex, and OpenCode real autonomy — installing packages, running tests, starting services, iterating on failures — without giving them your host machine. It is a deliberately small wrapper around Docker Sandboxes (the sbx CLI) that wires the common coding-agent loop together: the agent runs inside a disposable microVM against a private clone of your repository, your host repo stays read-only for the entire run, and the agent's changes come back as normal git commits that you fetch, diff, review, and merge from the host. The core insight is that harness-level permission rules are policy inside the agent process; Code Airlock moves the main safety boundary below the agent, so the agent can be configured to behave well while the microVM limits what happens when it does not. The workflow is three commands: code-airlock run "add pagination and run the tests", code-airlock diff, code-airlock merge — or open a pull request instead with code-airlock pr, pushed from the host with your credentials so the sandbox never needs GitHub access. It supports a configurable network allowlist for model APIs and package registries, per-repo stable sandbox naming, AGENTS.md scaffolding via code-airlock init, opt-in seeding of your personal agent config (commands, skills, subagents) without auth files or histories, tmux-based detached runs for remote servers, doctor and dry-run preflight checks, and visual review via your preferred difftool. Install via npm, Homebrew, or a shell script. MIT licensed; requires Docker Sandboxes with KVM/virtualization. No MCP integration — it wraps the agents themselves.