airlock is a disposable, hardened Linux sandbox for your Mac. Code goes in, does its work, and the container is destroyed on exit — without ever exposing your keys, files, or secrets.
// an airlock between sketchy code and your real machine
Modern development means constantly running code you didn't write — cloning OSS, installing hundreds of transitive dependencies, trying a tool from a random GitHub link. Any one can hide a malicious postinstall script or a compromised package. Install-time lifecycle scripts are the single largest code-execution surface in the npm ecosystem — a single compromised package anywhere in your dependency tree runs arbitrary commands on your machine, with access to ~/.ssh, cloud credentials, browser tokens and .env files.
| Attack step | Without airlock | With airlock |
|---|---|---|
| Read your secrets | Full home-directory access | Only the project folder is mounted |
| Send them out | Any internet host | Egress blocked except a domain whitelist |
| Persist / spread | Writes anywhere on disk | Read-only root, throwaway container |
airlock removes both halves of the attack — isolation stops the escape, egress control stops the exfiltration. Either one alone is not enough.
Real, widely-reported supply-chain attacks against the npm ecosystem — each one ran arbitrary code on developer machines during a routine install. Every source below is a primary advisory or major security-press report. Verify them yourself.
event-stream → bitcoin-wallet backdoorA trusted maintainer handed off the package to a new "contributor," who slipped in an obfuscated dependency (flatmap-stream) that harvested private keys from a specific bitcoin wallet app. It sat undetected for ~2.5 months.
ua-parser-js → password stealer + crypto minerAttackers hijacked the maintainer's npm credentials and published malware that installed a password stealer and a cryptominer on install. The threat was serious enough that CISA issued a public alert.
node-ipc → "protestware" that wiped filesThe maintainer shipped code that, on machines geolocated to Russia or Belarus, overwrote files on disk with a heart emoji. node-ipc is a transitive dependency of the Vue CLI — so the blast radius was enormous.
Shai-Hulud → the first self-propagating npm wormPhished maintainer tokens let malware steal cloud + npm secrets, publish them publicly, and republish itself into more packages automatically. CISA issued an ecosystem-wide alert. Install scripts fetched second-stage payloads from attacker infrastructure.
✓ Every link above points to a primary advisory (CISA, npm) or established security press — open the full reference list ↓
From everyday untrusted installs to genuinely hostile code and autonomous agents — airlock scales the isolation to the risk.
airlock run [cmd]
UNTRUSTED. OSS you don't trust, sketchy installers, client deploys.
airlock dev [cmd]
TRUSTED. Your own code — a clean, consistent, disposable Linux workstation.
airlock sbx [cmd]
MICRO-VM. Genuinely hostile code or an autonomous AI agent with shell access.
--fresh wipes · down destroysRule of thumb: default to run for anything you don't trust — light enough for all-day use, even on a 16 GB Air. Escalate to sbx only when a kernel-escape would be catastrophic. Use dev only for code you wrote.
run and dev share every one of these guards — defined in docker-compose.yml. sbx adds a separate kernel on top.
Runs as the unprivileged node user (uid 1000) — never root.
The entire root filesystem is immutable. Only tiny RAM-backed tmpfs mounts are writable.
cap_drop: ALL + no-new-privileges — no privilege escalation.
/home/node is a tmpfs, wiped on stop. Nothing persists between spins.
4 CPU · 4 GB RAM · 512 PIDs — fork bombs and runaway builds are blunted.
--rm means the box is gone the instant you type exit.
airlock's design mirrors how Anthropic contains Claude Code: filesystem isolation so a compromised process can't read your secrets, plus network isolation through a domain-filtering proxy so it can't exfiltrate them. Their own engineering team is explicit that you need both — without network isolation a compromised agent leaks your SSH keys; without filesystem isolation it escapes and gets network access anyway.
Same two primitives, packaged for your laptop: only the project dir is mounted, and egress runs through a default-deny whitelist (tinyproxy.conf).
Each spin is logged out, so you can also deploy for many clients without cross-account mix-ups or credentials left on disk.
Clone it, poke at it. If it's malware, it can't reach your keys or phone home.
airlock run
Every spin is logged out — vercel login fresh as the right client, no mix-ups.
airlock run
That one-liner install script runs contained instead of as you.
airlock run
From your Mac, without dual-booting. Path casing, native modules, line endings.
airlock dev
A microVM with its own kernel — even a container-escape 0-day can't reach your Mac.
airlock sbx
Give it room to work behind a hardware-enforced boundary and a tight whitelist.
airlock sbx
The folder you launch from becomes /workspace — the only host folder the container can ever see.
Ports 3000 · 3001 · 5173 · 4000 · 8080 forward to your Mac. Use -H 0.0.0.0 / --host 0.0.0.0.
Don't run run twice. Attach with airlock exec to jump into the same box.
Node 24.16 · pnpm · npm · nvm · git · ripgrep · Claude Code, plus vercel · netlify · heroku · firebase · wrangler.
Pass a one-off command instead of a shell anytime: airlock run npm test, airlock dev claude, airlock exec vercel deploy. Full source: the airlock CLI ↗
airlock run [cmd]🔒 UNTRUSTED mode — no history, whitelist-only network.airlock dev [cmd]⚠️ TRUSTED mode — Claude login + history, full internet.airlock sbx [cmd]🧊 STRONGEST — Docker microVM (own kernel) + the same whitelist.airlock exec [cmd]Open another terminal into the already-running sandbox.airlock allow <domain>Add a domain to the egress whitelist, then airlock rebuild.airlock blockedList the URLs/hosts the proxy denied — works even after you exit.airlock logsFollow proxy logs live — watch what's allowed and blocked.airlock sbx --freshDelete this project's old microVM and start a clean one.airlock sbx downDestroy just this project's microVM.airlock downStop & remove everything — run/dev containers, proxy, all sbx microVMs.airlock statusDashboard: images, what's running (🔒 SAFE / ⚠ TRUSTED), and the whitelist.airlock build / rebuildBuild images — rebuild is from scratch, no cache (apply a new whitelist).airlock helpShow help — also --help, -h.In run mode the sandbox has no direct internet. It sits on an internal Docker network and can only reach a tiny tinyproxy that forwards a request only if the destination host matches a rule — including HTTPS, by filtering the CONNECT host.
Default whitelist covers npm · yarn · pip · cargo, GitHub · GitLab, common deploy targets (Vercel, Netlify, Heroku, Cloudflare, Firebase) and Anthropic. Edit it in proxy/filter, or:
airlock blocked # lists denied hosts as URLs
airlock allow files.example.com
airlock rebuild # bake it into the proxy image
Exit run and the proxy + its network are torn down automatically — nothing internet-connected lingers.
Wipe or replace your Mac and you get airlock back the same way. setup.sh is idempotent and safe to re-run.
From backup or git clone. The token re-syncs from your Keychain — it's never backed up.
git clone <your-repo> ~/sandbox/airlockChecks Docker, makes the airlock alias, creates .secrets/, builds images, self-tests the whitelist.
bash ~/sandbox/airlock/setup.shFirst run pops a Keychain prompt → Always Allow.
cd <a project> && airlock runmacOS keeps your Claude login in the Keychain, not a file. airlock exports it to a chmod 600, git-ignored secret, mounts it read-only, and copies it into the container's ephemeral home. Token refreshes stay inside the box and are never written back to your Mac. dev mounts your full ~/.claude history; run mounts only the token — see entrypoint.sh.
airlock raises the cost of an attack significantly — but it's not a guarantee. Here's exactly what it does and doesn't cover.
AIRLOCK_SEED_CLAUDE=0 if that matters; revoke with /logout.One host CLI plus Docker plumbing — auditable end to end. Each file links to its source on GitHub.
Primary advisories and reporting from established platforms — government (CISA), the npm registry itself, Anthropic's engineering team, and major security press. Nothing here is second-hand.
Links open on the original publishers' sites. airlock is independent and not affiliated with, or endorsed by, any organization listed above.