machine — one isolated Lima VM per project, for running AI coding agents safely

[katspaugh]

Hi all 👋

I built machine, a small CLI (plus optional macOS GUI) that gives every GitHub project its
own disposable Lima VM — and I wanted to share it here since Lima is doing all the heavy
lifting.

• Site: https://runmachine.dev/
• Repo: https://github.com/katspaugh/machine

  brew install katspaugh/machine/machine
  machine up blog     # create + start + provision VM "blog", clone the repo
  machine ssh blog    # tmux shell at ~/code/blog

The itch it scratches

I run AI coding agents (Claude Code, Codex) in permissive/auto-approve
mode, and I didn't want them — or any project's dev dependencies — touching my host or
seeing my other projects. So each project gets its own VM: no host filesystem mounts at all,
code is cloned inside the VM over a forwarded SSH agent, and the only thing crossing the
boundary is a set of localhost port-forwards for dev servers.

What's in each VM: Docker, Node, the agent CLIs, gh, signed git (host key via agent
forwarding, never copied in), and opt-in tool profiles per project (Cypress, Supabase +
flyctl, Python, Rust, Go…). Declarative config in a projects.toml:

  [wallet]
  profiles = ["cypress"]
  repos = [
    "git@github.com:you/app.git",
    "git@github.com:you/api.git",   # multi-repo: sibling clones in one VM
  ]

How it uses Lima

• A single lima.yaml template (no mounts, fixed port-forward ranges) + limactl
  create/start/stop/delete driven by the CLI
• A small Python dispatcher pushed into the VM applies merged base + profile TOMLs, so
  machine rebuild reproduces the whole environment from scratch — that's my reproducibility
  test
• machine up maintains a block in ~/.ssh/config pointing at Lima's SSH port, so VS Code
  Remote-SSH / Cursor / JetBrains Gateway connect to the VM with zero extra setup
• machine ps gives a Docker-Desktop-style live table (uptime, CPU/mem, repo + branch, active
  ports) across all project VMs

Lima made this almost embarrassingly easy — the template + limactl surface was all I needed,
and agent forwarding "just works" for signed commits inside the VM. Thanks for the great
tool!

Happy to answer questions, and very open to feedback — especially if I'm holding Lima wrong
anywhere.