agent-run

Agent-run is a small command line tool for Linux that runs a coding agent like Claude Code, Codex, OpenCode, or a tool called pi inside a sandbox, so the agent cannot touch files outside your project even if it tries. The author built it because permission prompts from these agents got annoying, and wanted the agent to do whatever it wants inside the project folder while everything else on the machine stays read-only.

The tool is a single small binary, under one megabyte, that works on recent Linux systems using either the aarch64 or x86_64 processor architecture. It uses a Linux sandboxing tool called bwrap internally, embedded inside the binary itself, and requires unprivileged user namespaces to be enabled on your system. You can install it through Nix, through a tool called Mise, or by downloading the binary directly from the project's releases page and putting it in your PATH.

Configuration is written in TOML, a simple settings file format, with an available JSON schema so editors can offer autocomplete. By default, the whole filesystem is mounted read-only inside the sandbox, and you list specific paths, like a project directory or a tool's own config folder, that should be writable instead. You can also control whether the sandbox has network access and which environment variables get passed through from your host machine. Each supported agent, such as Claude Code or OpenCode, needs its own small set of writable paths configured so it can save its settings and temporary files correctly.

The author is clear that this is meant to catch mistakes an agent might make, not to stop a truly malicious program, since the read-only filesystem access alone still allows some forms of information leakage if network access is enabled. For that stronger level of isolation, the README suggests looking at microVMs instead. The project is written in Rust, built with Bazel, and released under the GNU General Public License, version 3.