A fresh Linux VM on your Mac in half a second
Throwaway Linux VMs on Apple Silicon, one per task or coding agent. A VM boots in half a second and answers SSH about two seconds after you hit enter. One Go binary, open source.
Needs Apple Silicon, macOS 26+, Homebrew and Go 1.26+. Check with skiff doctor.
A VM in one command
No boot to wait for. skiff new hands you a running Ubuntu 24.04 with root SSH, its own kernel, disk, IP and hostname.
A sandbox per agent
Coding agents want root, a package manager and the freedom to run whatever they just wrote. Give each one its own VM instead of your Mac. Create it per task, let the agent work, throw it away.
Run the agent inside
Start a VM, install your agent CLI over SSH and point it at a repo. It can apt install, run tests and open ports without ever touching your home directory or keychain. Credentials it needs come through the broker below, never as copies.
Many agents, side by side
Each VM has its own kernel, filesystem and IP, and the firewall drops traffic between them. Run several agents on different branches at once; none of them can see the others.
Execute untrusted code
Let the agent run the script it generated, a dependency you do not trust or a repo you just cloned. The VM only has internet. If anything goes wrong, skiff rm and start over.
Because every VM is a plain SSH host, anything that speaks SSH works unchanged: VS Code Remote, rsync for the repo, scp for the results, or your agent framework's remote executor. Forwarded ports bring the agent's dev server to localhost on your Mac.
Your credentials stay on the Mac
An agent in a VM still needs a git push, a Claude login or a browser MCP that only runs on your Mac. Copying tokens into the VM would throw the isolation away. skiff opens one controlled hole instead: a broker that hands out connections, never secrets.
Grant, don't copy
Store a token once in the macOS Keychain and grant it per VM. The guest only ever holds a placeholder; the broker on your Mac swaps it for the real credential on every request, and only while skiff ssh is open. Close the terminal, close the hole.
Default deny, fully audited
Every request is checked against the VM's grants and written to an audit log. GitHub reaches only the repositories your fine-grained token was made for. A denied request is answered with the exact command that would allow it.
Any tool, one TOML file
The broker knows three primitives: a header-injecting proxy, a bridge for MCP servers that run on your Mac, and an external program. Claude Code and GitHub ship built in. Codex, Gemini CLI or your own MCP server are a capability file in ~/.skiff/caps, shareable by URL. How it works
Size it as you need
Defaults are 2 vCPUs and 1 GiB RAM. Pass --vcpus and --mem to change them; the disk is a sparse volume that grows as the VM writes.
Default
2 vCPUs, 1 GiB RAM, disk grows on demand.
Bigger
4 vCPUs, 2 GiB RAM.
Find your VMs
List every VM with its state, IP, size, port forwards, grants and the SSH destination to use.
Stop keeps the disk, start brings it back, rm deletes it.
Plain ssh, scp, rsync, your IDE
Add one line to ~/.ssh/config and every VM is reachable as NAME.skiff. No port forwarding and no sudo needed on macOS.
Forward guest ports to localhost on the Mac. Forwards survive stop and start and go away with the VM.
Isolated by default
A real VM each
Every VM has its own kernel, disk and address on Apple's Virtualization framework, driven by Apple's container. No shared runtime VM, no nested virtualization, native speed for JIT-heavy agents.
Internet only
VMs reach the internet through NAT and nothing else by default: not each other, not your Mac, not your LAN. A firewall in the guest rejects private destinations; the broker is the one controlled way back.
Pinned host keys
skiff reads every VM's SSH host key on its first boot and pins it, so a VM that grabs a neighbour's address cannot pose as it. A failed create rolls itself back.
Open source
skiff is developed in the open by IT-Labs GmbH. Start with the documentation; source and issues live on github.com/sovyn-eu/skiff.