GitHub - minoansecurity/sidekernel: An easy-to-use macOS sandbox for Claude and other AI coding agents

Report · Site · Note from the developer

⭐ If this looks useful, a star helps others find it.
📣 Know someone who might like it? Feel free to pass it along.
🤝 Questions, ideas, and PRs of any size are always welcome.

SideKernel is a usable sandbox for AI coding agents (e.g. Claude Code). "Usable" means it tries to stay out of your way and to feel as if it's not there. It has zero third-party dependencies: the host uses only Apple's frameworks and the guest agent only Rust's standard library. It is developed as a capstone project for Georgia Tech's MSc in Cybersecurity.

Beyond AI agents, SideKernel is useful for trying out software without installing it on your host (e.g. untrusted npm packages).

Note

SideKernel is a research prototype until the stable release v1.0.0, not yet ready for production use. That said, it's already usable for running coding agents day to day, but use it responsibly and with the risks in mind. See the Report or sidekernel.com.

Install

Tested on M1 and M4 (macOS 26.2); other Apple silicon chips should work. If you tested it and ran into any issues, please open an issue.

Install with brew (recommended)

brew tap minoansecurity/sidekernel https://github.com/minoansecurity/sidekernel && brew trust --formula minoansecurity/sidekernel/sidekernel
brew install sidekernel

Install directly from source:

rustup target add aarch64-unknown-linux-musl
git clone https://github.com/minoansecurity/sidekernel
cd sidekernel
make install

The first run downloads a Linux kernel (from Kata Containers) and an Ubuntu base image, both pinned and checked against a SHA-256, and builds the root filesystem, so it might take a minute or two.

Usage

On the host (from a project folder):

sk          # launch an ephemeral microVM, current directory mounted
sidekernel  # (alias: sk)
sclaude     # launch a sandbox and start Claude Code directly
scodex      # launch a sandbox and start Codex directly

Log in on the host first (claude / codex login), or set ANTHROPIC_API_KEY / OPENAI_API_KEY on the host. The sandbox uses that login through a host proxy; your login files, API keys, and OAuth tokens stay outside the microVM.

Coming soon: sgemini, sgrok, and more.

Inside the sandbox:

sk-drop <host-path>   # copy a host file into the sandbox (requires approval on the host)
sk-net off/on         # cut internet access (the Claude API stays reachable); on needs approval on the host
save                  # persist installed packages across sandboxes
fightsong             # Print's Georgia Tech's fight song on the terminal 🐝 (alias: ramblinwreck)

You can also drag and drop files directly into Claude Code.

Limitations and Notes on Security

SideKernel is a research prototype and has limitations. The code has not had a formal security review or external audit. See threat model and limitations on sidekernel.com for the details, including the risks that are accepted by design. Implementation bugs are possible and sandbox escapes cannot be ruled out. Use responsibly.

Found a vulnerability? Please report it privately on GitHub. Reports are welcome and taken seriously, but fixes may take a little while. The project is still small and it's just me at the moment. Contributions are welcome.

Learn more

Note from the developer: the motivation and the honest trade-offs
Practicum Report: the capstone final report with design and evaluation details
Website

License

SideKernel is open-source software, licensed under the Apache License, Version 2.0.