brig-sh

Run a coding agent in a microVM on your own machine, with the credentials it needs and none of the ones it does not.

On macOS, with Homebrew, which brings the runtime with it:

brew tap brig-sh/brig
brew trust brig-sh/brig      # brew refuses untrusted third-party taps
brew install --cask brig

brig run claude ~/code/demo

Or without Homebrew. The script checks the archive against the published checksums.txt, and it does not check the cosign signature on that file:

curl -fsSL https://raw.githubusercontent.com/brig-sh/brig/main/install.sh | sh

That run mounts ~/code/demo read-write at /work/demo and starts the agent there. The sandbox boots with no credential, so the agent asks you to log in just as it does on a new machine.

The agent runs in a guest with its own kernel. Two host directories reach inside it: a guest home of its own, and the one project you name on the command line. Nothing else is mounted, and brig reads no credential out of your keychain, your SSH agent or your secret manager on the run path.

That mount is read-write, so an agent can change the project you handed it. What it cannot see is the rest of your disk. On the default network it can still reach the internet, so anything it can read it can also send. brig can filter egress on one backend, and refuses a policy-bound boot on any backend that cannot enforce it, rather than running unenforced.

brig is not a container runtime and does not try to be one. It delegates boot, exec and stop to the runtime underneath, and adds the four things neither has a concept of: a guest home plus a named project mount, credentials resolved on the host and forwarded per exec, a denylist for the provider keys that can silently move you onto metered billing, and a signature check on the guest image. Verification defaults to reporting an image it cannot verify and booting anyway. BRIG_VERIFY=require refuses one instead.

macOS 26 is what CI runs. Six of the eight agent profiles brig ships ask hull for its hvi backend, which needs macOS 15, so BRIG_HYPERVISOR=vz is the way past that floor on macOS 14.

The published guest images are arm64. Any Linux CLI in an OCI image runs as a bring-your-own image, so the agent profiles are a convenience rather than a requirement.

brig and hull are Apache-2.0 and Go. hvi-vmm is Apache-2.0 and Rust, builds from source, and publishes no crate and no release.

Released binaries carry a Developer ID signature and an Apple notarization ticket. Release checksums and guest images are signed with keyless cosign, so a signature is bound to the workflow that produced it rather than to a key somebody holds.

Two gaps worth naming. install.sh verifies the checksum and not the cosign signature on the checksum file, because that needs cosign installed. brig checks the boot bundle's signature at its registry reference without binding the kernel on disk to it.

Everything else, including where the boundary is weaker than it looks, is in brig's security documentation.

The Linux runtime, and hull on macOS, are based on urunc, a CNCF Sandbox project. urunc does the hard part, running unikernels and lightweight VMs as OCI containers, and hull carries that onto macOS.

Neither brig nor hull is a CNCF project, and neither is endorsed by the CNCF. The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our Trademark Usage page. urunc, CNCF and the CNCF logo are trademarks of The Linux Foundation.

Powered by NOFire AI