First screen, captured 7 days ago. Open the video.

Devvm.dev: One VM for every project

What HN thinks

Everyone is building the same agent sandbox VM, and everyone wants you to add theirs to the list.

Everyone is building one
Many commenters have their own libvirt, cloud-init, podman or qemu sandboxes for agents, and they trade notes on golden images, network containment and shared package stores.
Isolation is easy, access is hard
The real problem is giving agents scoped access to git, CI logs, registries and servers without leaking secrets, through proxies, machine accounts or scoped tokens.
Existing tools already cover this
Some see little gain over smolvm, Docker sbx, incus, bubblewrap or namespaces, and object to curl-pipe installs and the one-VM-per-directory assumption.

Consensus: Most agree VM-level isolation with secret shielding is worth having for coding agents. There's no agreement on which tool does it best, and many projects overlap.

Recommended in the comments

smolvm (tool): Users find it faster and more reliable than Lima-based setups and easy to build an agent harness on.
Incus ↗ (tool): It supports both VMs and containers with similar commands and lets you hot-plug mounts and secrets.
cloud-init (tool): Learning it lets the same VM setup work locally and in the cloud.
Canonical Workshop ↗ (tool): Suggested as a recently released alternative.
Bubblewrap (tool): Proposed as a lighter alternative to full VMs, though others noted it is Linux-only and has sharp edges.
DDEV (tool): One user said it works well and supports Node and other toolchains.

Summarised by Claude from the comment thread 6 days ago.

Points: 171
Comments: 68
Best rank: #11
Posted: 2026-11-06 by luispa
Category: DevOps & infra

devvm virtual-machines sandboxing coding-agents lima claude-code developer-tools

All captures:

Full page

Captured 7 days ago. Click for the whole screenshot.

Looks similar

Screenshot of github.com: Show HN: Godbolt-in-a-floating-window for Neovim (C, C++, Rust)

Show HN: Godbolt-in-a-floating-window for Neovim (C, C++, Rust)(github.com)

91 points by 0xdeadf1sh 2 days ago | 17 comments

GitHub repo for a Neovim Lua plugin that shows compiled x64/aarch64 assembly for C, C++, and Rust code in a floating window using local compilers.

neovim assembly lua c

Screenshot of github.com: Show HN: Codemap – one-page interactive map of any Go repository

Show HN: Codemap – one-page interactive map of any Go repository (github.com)

35 points by peter_retief 9 days ago | 16 comments

GitHub repository for codemap, a Go tool that generates a single searchable HTML page mapping a Go module's packages, internal dependencies, files and functions.

go code-visualization dependency-graph static-analysis

Screenshot of github.com: Show HN: Reflota – Open-source data recovery for NTFS/FAT disks with phased copy

Show HN: Reflota – Open-source data recovery for NTFS/FAT disks with phased copy (github.com)

15 points by christ_dev 13 hours ago | 2 comments

GitHub repository for Reflota, an open-source, read-only Windows tool for recovering deleted and lost files from NTFS, FAT and exFAT disks, with phased disk imaging.

data-recovery ntfs fat32 exfat

Screenshot of gyptazy.com: Live-migration support in FreeBSD and bhyve coming

Live-migration support in FreeBSD and bhyve coming (gyptazy.com)

66 points by JohnDohnBohn 5 hours ago | 16 comments

Blog post presenting a work-in-progress RFC implementation of live VM migration for bhyve on FreeBSD 15.1, covering design, test results, and blockers to upstreaming.

freebsd bhyve live-migration virtualization

Screenshot of github.com: Peer-to-peer WebRTC connections with built-in signaling and discovery

Peer-to-peer WebRTC connections with built-in signaling and discovery (github.com)

56 points by LuKks 5 days ago | 17 comments

GitHub repository for like-webrtc, a JavaScript library for peer-to-peer WebRTC connections with built-in signaling, cryptographic identities and peer discovery.

webrtc peer-to-peer javascript npm

Screenshot of syscall.sh: Show HN: I've updated my Linux System Call website and API

Show HN: I've updated my Linux System Call website and API (syscall.sh)

208 points by guitmz 11 days ago | 50 comments

syscall.sh is a reference site and API listing Linux system call tables, numbers, arguments and calling conventions for 27 CPU architectures across kernel versions.

linux-kernel syscalls system-calls cpu-architectures