Trail of Bits published coop, a Rust CLI running Claude Code and Codex inside disposable Firecracker or Lima microVMs.

Each project gets a throwaway VM where the agent has full tool access to Docker, git, compilers and package managers with no path back to the host (GitHub). coop setup installs Firecracker and a guest kernel on Linux; macOS goes through Lima via Homebrew. Usage is coop up then coop claude or coop codex. Compared to the devcontainer approach Trail of Bits published earlier, this is materially less setup for the same confinement, which matters because the sandbox you don't stand up protects nothing.