Late adopter. Started last night. Stayed up four hours past my normal bedtime because I couldn't stop. (Ended up "building" a fancy .MOD player for DOS in Turbo C.)
Needed the Max 5x plan after two hours. (The 'Pro' plan should be renamed 'Sampler', made one-time and free with CC details.) Max 5x seems like it can sustain my current appetite.
I very quickly went from thinking it was overpriced (around 100 USD/month) to worrying that this pricing can't last. I think I get about 50 working hours per week with this plan. So, running the numbers I guess the hourly cost is about 50 cents.
Install your OS of choice in a virtual machine, e.g. even hosted on your main machine.
Install the AI coding tool in the virtual machine.
Set up a shared folder between host+guest OS.
Only let the VM access files that are "safe" for it to access. Its own repo, in its own folder.
If you want to give the AI tool and VM internet access and tool access, just limit what it can reach to things it is allowed to go haywire on. All the internet and all OS tools are ok. But don't let this AI do "real things" on "real platforms" -- limit the scope of what it "works on" to development assets.
When deploying to staging or prod, copy/sync files out of the shared folder that the AI develops on, and run them. But check them first for subterfuge.
So, don't give the AI access to "prod" configs/files/services/secrets, or general personal/work data, etc. Manage those in other "folders" entirely, not accessible by the development VM at all.
Is that close?
SandVault [0]: Run AI agents isolated in a sandboxed macOS user account
ClodPod [1]: Run AI agents isolated inside an OSX virtual machine
[0]: https://lima-vm.io/
A fun fact about apple containers[2], it's more isolated than docker containers as in it doesn't share the VM across all containers.
edit: it only mounts $PWD
You can install it with brew or npm.
https://github.com/anthropics/claude-code/tree/main/.devcont...
With this I have a nice loop where I get Claude to analyse its own sessions via a cronjob and rewrite my devcontainer Dockerfile to have any packages that I've started using during the interactive sessions. This rebuilds via GHActions and my fresh image the next day has an updated Claude and dev environment in a sandbox.
https://simonw.substack.com/p/first-impressions-of-claude-co...
Given how many products seem to be using this shipping-Linux-as-a-library-VM trick these days, it's probably a good time for an open source project to step up to supply a more reusable way of assembling this layer into a proper Mac library...
It is not at all ready for public consumption (a face only a mother could love, in other words it's a bugridden mess), but I've considered polishing it and releasing it to the public either as open source or for profit.
Most of it is written with Claude and I've run into roadblocks with Claude being able to do too many things at once and am rewriting as several libraries to improve the focus for Claude agents.
And it makes a new lxd container using my base image. Connects using tmux so I can resume anytime after closing the session.
Its like exe.dev or sprites without much effort if you want to self host.
As I can't trust Claude Code to use a correct shell, I don't know why I would trust this feature.
GLM 4.7 is not a "Sonnet killer" but it will work just as well for sketching out easier projects, web design and terminal usage. After a while I cancelled my Claude Code plan because I simply didn't do anything that GLM couldn't hammer out equally as well.
`yolobox run claude` launches Claude Code with --dangerously-skip-permissions mode inside of a container with a good set of default tools included.
- https://github.com/anthropics/claude-code/issues/4331
Edit: At the very least, I would not allow it to do indiscriminate web searching.
I thought it was just a wrapper around an (old) existing tool that has been infinitely rebranded. Their old "remote desktop" program and some web listing capabilities to launch it in "rootless" mode.
https://simonwillison.net/2026/Jan/12/claude-cowork/
That’s the point of this gist, and the related blog post.
Also, it’s a bit of a stretch to call Claude Code, which isn’t even a year old…old.
