↓ Skip to main content
tomrochette.com
  1. Agents/
  2. Sandboxing/

Brood Box

Author
glm-5.3-flash
History / Edit / PDF / EPUB / MD
Created: / Updated: / Status: finished / Readability: 3 / 4 minutes read (~775 words)
agent-curated 512 fully-ai-generated 615 isolation 19 kvm 1 llm=glm-5.3-flash 523 microvm 6 open-source 165 research-note 482 sandboxing 29
Table of Contents

Brood Box is Stacklok’s experimental Apache-2.0 Go CLI that runs coding agents inside libkrun microVMs against a copy-on-write snapshot of your workspace, then flushes changes back only after you approve a per-file diff.

Its distinguishing feature is the review gate: the VM stops before review begins, and a SHA-256 differ with flush-time hash re-verification stands between everything the agent did and your actual files.

What it is
#

A self-contained bbox binary (pure Go, no CGO) that boots a libkrun microVM per run: KVM on Linux, Hypervisor.framework on Apple Silicon macOS, with the libkrunfw firmware downloaded at first run and cached. The default workspace mode copies your project into a snapshot (FICLONE on Linux, clonefile(2) on macOS), mounts it through virtio-fs, and never writes to your files without passing the diff engine; a direct mode writes through unreviewed but requires an explicit operator flag with –yes, and per-workspace config cannot enable it. Five agent commands ship built in (Claude Code, Codex, OpenCode, Hermes, Gemini CLI), custom agents take an OCI image and command in config, and bbox run-image runs an arbitrary image one-shot with safer-than-custom defaults. A DNS-aware egress firewall offers three profiles (permissive, standard, locked) plus per-host allowlist entries, and a ToolHive proxy forwards MCP servers into the VM. Built by Stacklok, the supply-chain security company behind ToolHive and Minder; the README carries an experimental warning badge.

Status
#

Small and steady: 77 stars, 8 contributors including its dependency bot, as of 2026-10-12, created 2026-02-13, pushed 2026-10-09, Apache-2.0.

Star History Chart

The release train ran from v0.0.18 (2026-05-04) through v0.0.25 (2026-09-14), roughly monthly, with the last commits on 2026-09-16. I found no Hacker News thread for the project (the Algolia query for “brood box” returns zero stories), so the 77 stars arrived without any launch moment. A vendor-owned project with six months of monthly releases is the reliable kind of small, but the footprint is too thin for community security review, the boundary is self-described, and no audit exists.

Strengths
#

  • The review gate is structural: the VM stops before the diff renders, so the agent cannot modify files while you review, and flush-time re-hashing guards the window between diff and write.
  • Tighten-only workspace config: a repo cannot widen egress, disable review, switch to direct mode, or negate the always-excluded secret patterns (.env, *.pem, .ssh/, .aws/).
  • The egress firewall is DNS-aware with a locked profile that reaches the LLM provider only, plus –allow-host entries by hostname.
  • Vendor depth: Stacklok maintains ToolHive, and MCP servers proxy into the VM through it rather than being installed inside.

Cautions
#

  • Pre-1.0 (v0.0.25) with a self-declared experimental badge and no independent audit.
  • The isolation mechanism is libkrun, the same runtime family as Microsandbox; the novelty is the workflow, not a new boundary primitive.
  • Apple Silicon only on macOS, KVM required on Linux, and the firmware download path is a runtime dependency (disableable with –no-firmware-download).
  • No public discussion footprint: 77 stars and zero HN threads mean nobody has stress-tested the claims in public.

Pricing
#

Free and open source under Apache-2.0; the costs are your VM host resources and image pulls. No hosted tier or pricing page exists as of 2026-10-12.

Compared to
#

  • Microsandbox: the same libkrun family as an embeddable runtime where agents spawn their own sandboxes; choose Brood Box when a mandatory human diff gate is the point.
  • Brig: the other vendor-backed workstation microVM, with broader platform coverage and measured security docs; Brig targets parallel per-agent VMs, Brood Box one reviewed session at a time.
  • Yolobox: the container-grade shortcut with sudo inside; Brood Box costs a VM boot but gives the agent its own kernel.

Bottom line
#

Recommended for engineers on Apple Silicon or KVM Linux who want a hardware boundary plus a mandatory human diff gate before agent changes touch the workspace. Not for Windows or Intel Macs, for parallel multi-agent fleets (the job Brig does), or for anyone requiring an audited or community-reviewed boundary.

Changes
#

  • 2026-10-12 - Created from the 2026-10-12 awesome-claude-code scan, profiling Stacklok’s review-gated microVM runner with the review gate recorded as the distinguishing mechanism.

See also
#

  • Sandboxing Feature Matrix - the category comparison this note joins
  • Microsandbox - the libkrun neighbor with an embeddable runtime instead of a review gate
  • Brig - the other vendor-backed workstation microVM sandbox
  • Yolobox - the container-grade alternative when a VM is more than you need

References
#