Give your AI coding agents their own machines, not your credentials

A template is a working environment, packages, tools and repositories, declared once and built once. isx branch creates and starts a new machine from it, with your code and all your tools already there. Where a git worktree gives you a second working copy in a new directory, an isx branch gives you one that is a whole machine, toolchain, dependencies and running services included. It shares everything unchanged with its template and costs only what it changes, so it is instant. And it starts ready to work: tools installed, repositories cloned, dependency caches warm.

Every branch is a machine of its own, with its own filesystem, network and processes: no port conflicts, no shared database, no interference between them. Take one per task: try five approaches in five branches and keep the one that works, and when an agent wrecks its machine, give it a new one with one command.

The whole machine means a real one. Application containers, the kind Docker and Podman run by default, are built for shipping applications: a minimal filesystem, one process, fast startup. isx is built for a different job, so an isx sandbox is a workstation: a full system container powered by Incus, or a KVM virtual machine, that behaves like a real machine. Each one runs its own init system, has real networking (ping, strace, nested Podman/Docker), and supports GUI and audio passthrough.

What you hand an agent is an investigation, and nobody knows at the start what tools it will need. Templates pre-install your baseline tools and repos, but what the agent gets is a real Linux system. It can dnf install, pip install, build from source, or run Docker Compose just like on a workstation. For the strongest isolation, KVM virtual machines add a separate kernel and hardware-level separation. How this compares with other sandboxes →

Inside its machine the agent can do anything, with no approval steps for you to babysit. That is safe only because the machine holds nothing worth stealing. API keys and tokens never enter it in any form. Instead, a transparent proxy on your host adds the real credentials to the agent's requests as they leave the machine. Neither the agent nor its tools know it is there: claude, pi, gh, git and curl work unmodified, with nothing to configure, signed in as the accounts you assign.

Branches run with full internet, proxy-only egress, or completely airgapped. The proxy also caches container image layers and build artifacts on the host, so the same dependency is never downloaded twice.

In a git worktree, the commits land in your repository as you make them. A branch is a separate machine, so it gets a git remote instead, managed for you. From there on it is the workflow you know: git fetch, then git diff, git cherry-pick or git push. You review a specific, immutable commit, never a directory the agent can still change.

Your editor reaches in too: VS Code Remote and JetBrains Gateway attach over SSH from the first start, and agent skills are baked into the template.

The built-in TUI: browse templates and running machines, hit F4 to branch, and land in Claude Code on the fresh machine before you finish reading this sentence. Everything it does is also a command, for your shell and your scripts.

And isx is an MCP server. The agent on your host stays as constrained as you like, and can still take on research that needs software you would rather not install on your computer: a tracer, a database, a service to run against, a whole toolchain. It branches a machine of its own from a template you approved, works there or hands the task to the agent inside, and brings back the result. Your computer keeps the constraints; the disposable machine gets the freedom.