# Create a named VM with mounted directories
clod create myproject --dir project:/path/to/project
clod create feature-a --dir work:/path/to/repo/.worktrees/feature-a

# SSH into a named VM
clod shell myproject

# Multiple VMs can run simultaneously if memory budget allows
clod shell feature-a    # starts alongside myproject

# List named VMs
clod list

# Clean up
clod destroy myproject
clod destroy --all

Memory budget

By default, VMs share a memory budget of 5/8 of host RAM. You can configure per-instance RAM and the total budget:

# Set RAM for a specific instance (takes effect on next launch)
clod set --ram 8G myproject

# Set workspace memory budget
clod set --max-memory 16G

# Create with specific RAM
clod create dev --ram 10G --dir project:/path

# Override RAM for one session
clod shell --ram 6G dev

# Split budget across multiple VMs (default: 1)
clod set --vm-count 2

# Reset to dynamic (use remaining budget)
clod set --ram default dev
clod set --max-memory default
clod set --vm-count default

macOS versions

By default ClodPod uses the ghcr.io/cirruslabs/macos-tahoe-xcode:latest VM flavor, but this is configurable by setting the MACOS_VERSION and MACOS_FLAVOR environment variables when building the VM:

MACOS_VERSION=sequoia MACOS_FLAVOR=vanilla clod shell

See the cirrus packages page on Github to see the available alternatives.

Setup notes

By default the guest CPU count is set to be identical to the host system, and guest memory to 5/8 * host memory (NOTE1) to provide resources for compiling projects in Xcode.

NOTE1: This value was empirically calculated (N=1) to leave plenty of memory for web-browsing, which I shouldn't be doing anyway.

Optional virtual machine configuration (example):

tart set clodpod-xcode --cpu 8
tart set clodpod-xcode --memory "$(( $(sysctl -n hw.memsize) * 2 / 3 / 1024 / 1024 ))"

Add your own tools and configuration

To add custom configuration; see ./guest/home/README.md.

Background

This project exists because I was foolishly trying to find a way to insulate my computer from destruction by rogue AI agents when running (e.g.) Claude Code with --dangerously-skip-permissions (to avoid frequent "do you want to proceed?" dialogs), when perhaps I should have simply learned to accept their infrequent rages.

I experimented with running AI agents inside docker and podman containers (i.e. in Linux), but as my goal ultimate is to build apps using Xcode, I wanted to stick with OSX.

I considered using xtool, but instead went down a different rabbit hole and tried providing the containers with limited access from the guest OS to my host computer using GNU Rush (Remote User SHell). This worked but was limiting.

I then tried limiting filesystem access using exec-sandbox, and it works in a "proof-of-concept" sort of way, but the attack surface area was too large. I expect I'll come back to this because sandboxing is quite interesting all by itself.

Eventually I settled on running the whole thing inside a virtual machine, which is probably where I should have started.

In any event, this project is the result. Hope you like it.

Alternatives

• SandVault runs AI agents in a limited user account on macOS.
• Chamber is a proof-of-concept app for running Claude Code inside a macOS virtual machine.
• Claude Code Sandbox runs Claude Code in a Docker container (Linux)

License

Apache License, Version 2.0

ClodPod Copyright © 2025 Patrick Wyatt

See LICENSE.md for details.

Contributors

We welcome contributions and bug reports.

See CONTRIBUTORS.md for the list of contributors to this project.

Thanks to

This project builds on the great works of other open-source authors:

• Tart: macOS and Linux VMs on Apple Silicon (licensed under FSL-1.1-MIT; free for individuals, commercial use may require a paid license)
• Homebrew: 🍺 The missing package manager for macOS (or Linux)
• Sqlite: The most used database engine in the world
• Shellcheck: finds bugs in your shell scripts
• uv: An extremely fast Python package and project manager, written in Rust
• Claude Code Hooks Mastery: Quickly master how to use Claude Code hooks to add deterministic (or non-deterministic) control over Claude Code's behavior
• StatusLine: project status information for Claude Code

... as well as GNU, BSD, Linux, Git, Sqlite, Node, Python, netcat, jq, and more. "We stand upon the shoulders of giants."