Run Claude Code in a sealed VM for PRs

They confined Claude Code to a restricted virtual machine so it could draft changes and open PRs without direct access to secrets or merges.

Done with Claude Codeยท Advancedยท Oct 2026

What they did
They placed Claude Code in its own VM and boxed it in with a narrow network path. The machine could talk only to the internet, their Forgejo server, Infisical, and a one-way SSH link from the author's computer. Credentials were supplied through Infisical, and the agent's Forgejo account was limited to creating issues and pull requests.
How it went
They reviewed and merged changes themselves, then CI built the code and pushed it to an app server VM. No metrics were reported, but the author described the arrangement as overly cautious in a good way because it reduced the chance of personal data leaving the system. In local development mode, some secrets can still surface.
Tips
Keep the agent off merge and deploy permissions if you want the same safety model. Also separate local dev from the hardened setup, since that mode can still expose secrets.

Try it yourself with Claude Code

Help me build a restricted virtual machine for Claude Code to use with [repo name]. Limit its access so it can read the repository, retrieve credentials through [secrets manager], and create issues and pull requests on [Git host], but cannot merge, deploy, or take any irreversible action. Guide me step by step, and before any command that changes credentials, access, or system settings, pause and ask for my approval. End by opening a small test pull request.

Fill in the [brackets]. Agents can make mistakes, so review anything before it is sent, paid or deleted.

Read the original on news.ycombinator.com โ†—

Get 3 agent uses like this every morning

With the day's top AI news. Free, and one click to unsubscribe.