Coop – Isolated VM Environments for Running Claude Code and Codex
TL;DR Highlight
Run Claude Code and Codex with full tool access inside disposable VMs to protect your host
Who Should Read
Developers who want coding agents to use Docker, git, and package installs but worry about their machine and other projects
Core Mechanics
- Agents live inside a VM
- coop is a Rust CLI that manages disposable virtual machines for Claude Code, Codex, and Grok Build.
- Inside the VM they can use Docker, git, compilers, and package managers.
- The host stays separate
- Each VM is described as isolated, reproducible, and cheap to create and destroy.
- Commands are simple
- Run coop up in a project folder to start an instance.
- Then launch an agent with coop claude, coop codex, or coop grok.
- Build a template image first
- coop setup builds the VM template image.
- On Linux it also installs Firecracker and fetches a guest kernel.
- macOS needs Lima
- On macOS, install Lima with brew install lima first, or setup fails.
- It is tested on macOS arm64 and Linux x86_64, while Linux arm64 builds are available but untested.
Community Reactions
- Questions about alternatives
- Commenters asked how it differs from docker sbx, microsandbox.dev, and bubblewrap-based sandboxes, and whether it is safer.
- Daily-use experience
- One user said it is convenient for running agents without access to other projects or personal files.
- They added that a motivated agent might still escape.
- Other tools mentioned
- Commenters said they use Eclipse Enclave, cco, and drydock (macOS only).
- Permission fatigue approach
- One commenter used toolgate to auto-approve safe tool calls and ask only for riskier ones declaratively.
- They complained about too many unnecessary permission requests.
How to Apply
- Try coop on a test repo
- Run coop setup, coop up, and coop claude in a non-critical project.
- Have the agent install packages and use Docker, then confirm the host is unaffected.
- Pin your dev environment with post_create
- Put your team's tool install commands in the global post_create.
- Check that every new VM ends up identical.
- Share config with guest_files
- Pick only the dotfiles the agent needs and list them in guest_files.
- Copy only what is needed, not your whole home directory.
- Build a sandbox comparison
- Run the same task in docker sbx, microsandbox, bubblewrap, and coop.
- Compare setup difficulty and OS support.
Try It
# Paste into a terminal (on macOS, run brew install lima first)
curl -fsSL https://raw.githubusercontent.com/trailofbits/coop/main/install.sh | bash
coop setup
cd ~/code/{{project_path}}
coop up
coop claude
# Next: try coop codex or coop grok insteadTerminology
Related Papers
Same Simulation, Different Evidence: Where Retrieved Tool Output Costs LLM Agents Accuracy
Saving long tool output to files cut GPT-5.1 accuracy by 11.3 points; naming the authoritative file restored it.
Fake News, Real Crashes: Information Injection Attacks on LLM Financial Trading Agents
Fake headlines hijacked LLM trading agents 62% of the time versus 14% for prompt injection.
Harness Engineering 101: The LLM is the brain, the harness is the body
An agent is a loop managing a JSON array; 16 chapters build one from scratch
Harness2 by Google Research – Recursive Agent Harnessing
Recursively refining the harness with fixed model weights raised benchmark scores by up to 11.8 points.
Ousted Savannah police officer gave ICE agent husband access to Flock system
A police officer shared her Flock login with her ICE-agent husband; an audit found 983 searches and she was fired
Tmux and Claude Code: Sessions, Send-Keys, and the Ceiling
Running Claude Code agents in tmux works well, but limits appear around four agents.