SideKernel: A Usable microVM Sandbox for AI Coding Agents on macOS

Dimitrios Prasakis

cs.CROct 1, 2026

SideKernel: A Usable microVM Sandbox for AI Coding Agents on macOS

Authors: Dimitrios Prasakis

Organizations: Georgia Institute of Technology

Abstract

AI coding agents are untrusted system components, yet they require autonomy on the developer machines they run on. This contradiction is a security problem. Sandboxes provide an isolated environment, but for local macOS development, the existing local, open-source options for AI coding agents are few in number and cumbersome to use. I conducted a formative online user survey which indicates that fewer than 40% of AI coding agent users run their agents in a sandbox and identifies the top usability barriers hindering AI coding agent sandbox adoption. These findings are used to develop SideKernel: an open-source, local, microVM-based macOS sandbox for AI coding agents designed for usability. To evaluate SideKernel, I compiled a list of sandboxes available on the market and filtered it against five inclusion criteria. Then I performed a comparative analysis between SideKernel and the sandboxes that satisfy these criteria, across 23 capability tests derived from the usability barriers revealed by the user survey. I discovered that only a few sandboxes are similar to SideKernel, and that among those, Docker Sandboxes and SideKernel score highest on capability features related to usability. A secondary contribution of this paper is a survey of the existing solution space for local, open-source, microVM-based macOS sandboxes for AI coding agents.

Figures & tables

Figure 1: North & South Security Boundaries

Figure 2: SideKernel research methodology.

	Inclusion requirements					Isolation
Sandbox	IR-1 Source	IR-2 Local	IR-3 Shell	IR-4 HW-virt.	IR-5 macOS	Isolation Mechanism(s)	Class
nono	✓	✓	✓	✗	✓	Seatbelt / Landlock	Shared Kernel
Landrun	✓	✓	✓	✗	✗	Landlock	Shared Kernel
Fence	✓	✓	✓	✗	✓	Seatbelt / bubblewrap	Shared Kernel
Daytona	✓ a	✗	n/a b	n/a b	n/a b	Shared Kernel / microVM	Cont. / Sep. kernel
Yolobox	✓	✓	✓	✗	✗ c	Docker/Podman container	Shared Kernel

Table I: Inclusion requirements and isolation classification. IR-1: open-source; IR-2: local execution; IR-3: interactive shell for CLI agents; IR-4: hardware-virtualized; IR-5: macOS

Figure 3: Filtering process against inclusion criteria.

Figure 4: Usability barriers reported by current and former sandbox users ( $n=33$ ).

UB	Boundary	Design Goal	Mechanism	Implemented	Risk Description
UB-1	South	The current folder is the sandbox	Implicit bidirectional current directory mount with VirtioFS	✓	The agent may read, edit or destroy anything in the mounted directory
UB-1	South	External (non-mounted) files or directories reachable at runtime, with explicit consent	Command sk-drop with host-side approval. Drag and drop works into SideKernel Claude’s sessions	✓	—
UB-1	South	Copy and paste works between the host and SideKernel’s Claude sessions	Bidirectional text (and image) clipboard	✓	—
UB-2	South	Exposed sandbox ports are automatically available on the host	SideKernel auto-detects and forwards guest ports to 127.0.0.1	✓	A malicious agent can open ports to the host, exposing malicious services.
UB-2	North	Block all internet/external traffic, while the Claude agent still works	NAT kill-switch, Claude inference endpoints allowlisted by default	✓	—
UB-3	South	SideKernel feels like a second PC (e.g., installed packages and configurations persist across sandboxes)	Runtime OverlayFS persistence with a personalized SideKernel image, using the in-guest save command	✓	—

Table II: SideKernel design goals traced to the usability barriers of Section V and the boundaries of Section II-B

Sandbox	T1	T2	T3	T4	T5	T6	T7	T8	T9	Pass
Docker Sbx	✓	✓	✗	✓	✗	✗	✓	✓	✓	6
Microsandbox	✓	✗	✗	✓	✗	✗	✓	✓	✓	5
Shuru	✓	✓	✗	✗	✗	✗	✓	✓	✓	5
SmolVM	✓	✗	✗	✓	✗	✗	✓	✓	✓	5
VibeBox	—	—	—	—	—	—	—	—	—	—
SideKernel	✓	✓	✗	✓	✓	✓	✓	✓	✓	8

Table III: UB-1 — Host–sandbox file sharing

Sandbox	T1	T2	T3	T4	T5	Pass
Docker Sbx	✓	✓	✓	✓	✓	5
Microsandbox	✗	✓	✗	✓	✓	3
Shuru	✗	✓	✗	✓	✓	3
SmolVM	✗	✓	✗	✓	✓	3
VibeBox	—	—	—	—	—	—
SideKernel	✓	✓	✗	✓	✗	3

Table IV: UB-2 — Networking, ports & localhost

Sandbox	T1	T2	T3	T4	T5	T6	T7	T8	T9	Pass
Docker Sbx	✓	✗	✓	✓	✓	✓	✓	✓	✓	8
Microsandbox	✗	✗	✓	✓	✓	✓	✗	✗	✗	4
Shuru	✗	✗	✓	✓	✓	✓	✗	✗	✗	4
SmolVM	✗	✗	✓	✓	✓	✓	✗	✗	✗	4
VibeBox	—	—	—	—	—	—	—	—	—	—
SideKernel	✓	✓	✓	✓	✓	✓	✓	✓	✗	8

Table V: UB-3 — Environment provisioning & setup

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

ID	Name	Definition
T1	Mount CRUD, both directions	Read, create and delete the mount dir file mount/workspace-file.txt and validate bidirectionally all actions.
T2	Mount mode propagation, both directions	Run chmod 777 mount/shell.sh . Test that all the permission bits (r, w, x) carry across.
T3	Mount inode notification, host $\to$ sandbox	Run inotifywait on workspace-file.txt inside the sandbox, then edit the file on the host. Test that the notification fired.
T4	Unmounted file transfer, host $\to$ sandbox	Test whether <HOST-PATH>/external-file.txt can be accessed and read inside the sandbox, without host-side commands, without sandbox restart, and with explicit approval. a
T5	Clipboard image, host $\to$ Claude in sandbox	Copy an image to the host clipboard. Test that it pastes into the Claude session inside the sandbox.
T6	Clipboard text, sandbox $\to$ host	Copy text from the Claude session inside the sandbox. Test that it pastes on the host.

Appendix

Table VI: UB-1 — Host–sandbox file sharing: full task definitions

ID	Name	Definition
T1	Runtime port forwarding	Run python3 -m "http.server" 5000 inside the sandbox. Configure port forwarding without restarting the sandbox for 5000. Test that curl localhost:5000 is reachable from the host.
T2	Restart port forwarding	Run python3 -m "http.server" 6000 inside the sandbox. Test that curl localhost:6000 is reachable from the host after explicitly configuring port forwarding.
T3	DNS connection URL logs visible	Provides a DNS network log panel listing the websites connected to.
T4	Egress control, blocking	Test that blocking outbound internet access is feasible with a built-in sandbox mechanism enforced by the hypervisor. Run the sandbox and block all traffic.
T5	Egress control, allowlisting	If blocking outbound internet access is feasible, test whether allowlisting is feasible natively, enforced by the hypervisor. Run the sandbox and allowlist curl https://example.com .

Appendix

Table VII: UB-2 — Networking, ports & localhost: full task definitions

ID	Name	Definition
T1	Agent preinstallation	Test that claude --version succeeds on first boot, without the tester installing it manually.
T2	Credential inheritance	Ensure Claude is authenticated on the host. Test that the agent completes a prompt–response round-trip inside the sandbox without the tester performing a login in the sandbox.
T3	Agent state persistence	Restart the sandbox. Test that Claude is still present and authenticated.
T4	Configuration file persistence	Define alias print_hi in the sandbox shell rc, and restart it. Test that print_hi resolves.
T5	Package installation persistence	Run pip install -r requirements.txt , and restart it. Test that python -c "import numpy" exits successfully.
T6	Git state visibility	Run git init . on the host and create a new file called git.txt . Enter the sandbox and run git diff . . Test whether git.txt appears on the diff.

Appendix

Table VIII: UB-3 — Environment provisioning & setup: full task definitions. For each task, the tester checkpoints the sandbox (if applicable)

Question / Response	n	%
Q1. Do you currently use AI coding agents? ( $N=80$ )
Yes	68	85.0
No	12	15.0
Q2. Professional role ( $n=68$ )
Cybersecurity (Engineering, OffSec etc)	23	33.8
Software developer or engineer	14	20.6

Appendix

Table IX: Complete Google Survey results

AI Coding Agents

AI coding agents use language models and software tools to plan, edit, test, and maintain code with varying levels of autonomy.

See all 329 papers

MacAgentBench: Benchmarking AI Agents on Real-World macOS Desktop
Jun 21, 2026Yikun Fu, Bowen Fu, Zhenyu Wu +10AI Agent Benchmarks Computer-Use Agents
1Shanghai Jiao Tong University · 2Shanghai AI Laboratory · 3Xi’an Jiaotong University +5
Tracekit Box: Running AI Agents in Micro-VMs Where Every Way Out Is Decided and Signed
Oct 28, 2026Bravish GhoshRuntime Enforcement for AI Agents AI Agent Security
Cygnux Labs
When Does Restricting a Coding Agent to execute_code Help? A Regime $\times$ Agent-Design Ablation
Jul 12, 2026Hong Yang, Qi Yu, Travis DesellCoding Agents Tool-Using Agents
Rochester Institute of Technology Rochester, New York, USA

Jun 21, 2026J/K move · Enter open · S save

MacAgentBench: Benchmarking AI Agents on Real-World macOS Desktop

Yikun Fu, Bowen Fu, Zhenyu Wu, Shuang Cheng+9

1Shanghai Jiao Tong University · 2Shanghai AI Laboratory · 3Xi’an Jiaotong University+5

AI Agent Benchmarks Computer-Use Agents Long-Horizon Agent Evaluation Computer-Use Agent Benchmarks Automated Evaluation Computer-Use Agent Evaluation+1

Open paper AskPDF arXiv

Computer use agents (CUAs) have advanced rapidly in desktop automation, and a growing number of users deploy CUAs such as OpenClaw on Mac Mini for always-on automation. However, existing benchmarks, including those for macOS, evaluate agents without framework augmentation and rely on binary evaluation. As a result, they fail to capture both the framework capabilities leveraged by modern CUAs and the partial progress on long-horizon, multi-application tasks. We present MacAgentBench, a comprehensive macOS agent benchmark comprising 676 tasks across 25 applications, with nearly 60% involving both GUI and CLI interaction. The benchmark adopts deterministic rule-based evaluation and introduces fine-grained multi-checkpoint scoring with capability annotations for multi-application tasks. Experiments across three frameworks and 16 models show that the best configuration, Claude Opus 4.6 on OpenClaw, attains 73.7% Pass@1, while this advantage is primarily driven by the skill library rather than by framework design. Fine-grained metrics further reveal that models with similar Pass@1 can differ substantially in sub-goal completion. Our code and data are publicly available at https://github.com/JetAstra/MacAgentBench.

Abstract

AI Coding Agents

Explore similar work

MacAgentBench: Benchmarking AI Agents on Real-World macOS Desktop

Tracekit Box: Running AI Agents in Micro-VMs Where Every Way Out Is Decided and Signed

When Does Restricting a Coding Agent to execute_code Help? A Regime ×\times× Agent-Design Ablation

When Does Restricting a Coding Agent to execute_code Help? A Regime $\times$ Agent-Design Ablation