Hardware-isolated sandbox for running coding agents on your repos, on macOS. The agent never sees your real API key; egress is deny-by-default; only a diff you approve leaves the sandbox.
https://sricola.github.io/drydock/ ↗// readme
drydock
drydock runs Claude Code, OpenAI Codex, or any OpenAI-compatible
model (Gemini, OpenRouter, local) full-throttle on your own repos, on your
own Mac — no permission prompts, no babysitting. Each task runs sealed in a
throwaway VM. The only thing that ever comes back is a git diff, and nothing
reaches your real code until you approve it.
- It never gets your key. Your real API key stays on the host; the agent only ever sees a short-lived, budget-scoped token (spend overshoot is bounded to one in-flight request by default).
- It can’t smuggle anything out. The internet is deny-by-default: no exfiltrating your code, no calling home (you allow the package registries it needs, nothing else).
- Nothing touches your repo until you say so. You read the diff and approve
it before it ever reaches
origin.
Most agent tooling tries to keep the agent well-behaved: permission prompts, output filters, policy. drydock takes the opposite stance: contain the blast radius. A hostile agent — a poisoned repo, a malicious dependency,…