Code Airlock

Code Airlock is a command-line wrapper around Docker Sandboxes. It runs Claude Code, Codex, OpenCode, or another coding agent in a disposable microVM, then returns the work as Git commits you can review on the host.

Coding agents are useful when they can run with fewer interruptions. They are dangerous when they have the host checkout, credentials, and network. The usual choice is either babysit every command or give the agent the machine.

I designed and shipped an isolation workflow that keeps the host repository read-only, gives the agent a private clone, and makes review the default path back to the host. Network access is allowlisted. The agent does not need GitHub credentials for the fetch, diff, and merge loop.

Host checkout stays read-only. The agent works in a disposable microVM against a private clone. Commits come back through fetch and merge. Optional GitHub access is explicit and separate from the default review loop.

Choices that mattered

Use Git as the review surface instead of a custom diff UI. Engineers already know how to read commits.

Keep clone mode as the default so the host tree is never the agent workspace.

Make network policy configurable rather than pretending isolation is binary.

What came of it

CLI for setup, attach, review, merge, and pull-request workflows.

Support for Claude Code, Codex, OpenCode, and other Docker Sandbox agents.

Configurable network controls and disposable sandbox state.

Open source under MIT.

A concrete control plane for unattended coding agents without handing them the host machine.