Safely Run AI Agent Code with Claude Code in a Virtual Machine

What you’ll get

A safe, throwaway “sandbox” (an isolated virtual machine, a whole computer running inside your computer) where you can let Claude Code run with permission checks turned off, without any risk to your real system. The --dangerously-skip-permissions flag lets the AI agent run commands without stopping to ask you each time, which is fast but risky on your real machine, and perfectly safe inside a disposable VM. It is advanced: you set up virtual-machine tooling and a config file, but every command and file is given.

Tools you need

• VirtualBox (free): runs the virtual machine on your computer.
• Vagrant (free): sets up and manages that VM from a single config file, so it is reproducible.
• Claude Code (paid): the AI agent you run inside the VM. Needs a paid plan or credits.
• Ubuntu, Node.js, npm, git, Docker (free): the Linux system and tools installed inside the VM (Vagrant installs these for you).

Steps

1. Install VirtualBox: download and install it from its official site.

2. Install Vagrant: install it from its site, then confirm with:

   vagrant --version

3. Make a project folder:

   mkdir my-project
   cd my-project

4. Create the Vagrantfile: this single file describes the whole VM. Create a file named Vagrantfile (no extension) in the folder and paste this in exactly:

   vm_name = File.basename(Dir.getwd)
   Vagrant.configure(2) do |config|
     config.vm.box = "bento/ubuntu-24.04"
     config.vm.synced_folder ".", "/agent-workspace", type: "virtualbox"
     config.vm.provider "virtualbox" do |vb|
       vb.memory = 4096
       vb.cpus = 2
       vb.gui = false
       vb.name = vm_name
     end
     config.vm.provision "shell", inline: <<-SHELL
       export DEBIAN_FRONTEND=noninteractive
       apt-get update
       apt-get install -y docker.io nodejs npm git unzip
       npm install -g @anthropic-ai/claude-code --no-audit
       usermod -aG docker vagrant
       chown -R vagrant:vagrant /agent-workspace
     SHELL
   end

   This sets up an Ubuntu VM with 4GB of memory and 2 CPUs, shares your project folder into the VM as /agent-workspace, and installs Docker, Node.js, git, and Claude Code inside it.

5. Start the VM: this downloads the Ubuntu image (first time only) and installs everything:

   vagrant up

   It takes a while the first time. Wait for the “machine is up” message.

6. Enter the VM: connect to it:

   vagrant ssh

   Your prompt changes to something like vagrant@ubuntu-2404:~$, you are now inside the VM.

7. Run Claude Code with permissions off (safely): move into the shared workspace and start it:

   cd /agent-workspace
   claude --dangerously-skip-permissions

   Claude Code now runs commands without pausing to ask, contained entirely within the VM. Your files are visible because the folder is shared.

8. Clean up when done: leave Claude Code, exit the VM, and optionally delete it:

   exit

   Then, back on your own machine:

   vagrant destroy -f

   That removes the VM completely, freeing the disk and memory.

Original source

Based on “Running Claude Code dangerously (safely)” by Emil Burzo, shared on Hacker News, on using an isolated VM to run an AI agent with elevated permissions without risking your real system.

Notes & variations

• Free-tier alternatives: VirtualBox and Vagrant are free. Vagrant also supports other VM backends like Hyper-V (Windows Pro) or KVM (Linux) if you prefer.
• Common mistake: forgetting to cd /agent-workspace after vagrant ssh. Run it there, or Claude Code will not see your project files.
• Tip for better results: keep your virtualization software updated. The author hit a high-CPU bug on one VirtualBox version; updating, or checking the project’s issues for a workaround, usually fixes such regressions.