Run a coding agent in a sandbox it cannot escape, with the credentials it needs and none of the ones it does not.
curl -fsSL https://raw.githubusercontent.com/brig-sh/brig/main/install.sh | shOr with Homebrew, which also brings the macOS runtime:
brew tap brig-sh/brig
brew trust brig-sh/brig # brew refuses untrusted third-party taps
brew install --cask brig
brig run claudePut the projects the agent should work on in ~/brig/claude-code. That
directory is the agent's entire world; the rest of your machine is invisible
to it.
The agent runs in a guest with its own kernel. It sees one directory and the credentials you chose to forward, and nothing else -- not your keychain, not your SSH agent, not the rest of your disk. That inaccessibility is the boundary, and it is also why credentials have to be forwarded in explicitly.
brig is not a container runtime and does not try to be one. It delegates boot, exec and stop to the runtime underneath, and adds the four things neither has a concept of: the workspace as guest home, credentials resolved on the host and forwarded per exec, a denylist for the provider keys that would silently move you onto metered billing, and signature verification of the guest image before it boots.
| runtime | status | |
|---|---|---|
| macOS 26+, Apple Silicon | hull over Virtualization.framework | supported |
| Linux, arm64 and amd64 | urunc over containerd (io.containerd.urunc.v2) |
supported |
| macOS, Intel | -- | not supported |
Guest images are arm64 today. Any Linux CLI in an OCI image runs as a bring-your-own image; the agent templates are convenience, not a requirement.
| brig | the CLI and the session daemon |
| hull | the microVM runtime on macOS, built on urunc |
| community-images | guest images, with open Dockerfiles |
| homebrew-brig | the Homebrew tap |
Everything we publish is signed. Binaries carry a Developer ID signature and an Apple notarization ticket; release checksums and guest images are signed with keyless cosign, so a signature is bound to the workflow that produced it rather than to a key somebody holds.
The Linux runtime, and the macOS one underneath hull, is urunc, a CNCF Sandbox project. urunc does the hard part -- it runs unikernels and lightweight VMs as OCI containers -- and hull carries that onto macOS, on top of Virtualization.framework.
Neither brig nor hull is a CNCF project, and neither is endorsed by the CNCF. The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our Trademark Usage page. urunc, CNCF and the CNCF logo are trademarks of The Linux Foundation.
Powered by NOFire AI