Run Claude Code in an isolated VM that opens PRs
The author runs Claude Code in a restricted VM with secrets served from Infisical. It can only create issues and PRs on Forgejo, and merges are manual before CI deploys.
Done withClaude Code
- What they did
- Claude Code runs in its own VM on a heavily restricted VLAN that can reach only the internet, the author's Forgejo instance, Infisical, and one-way SSH from the author's machine. Secrets come through Infisical, so the agent never sees them. Its Forgejo user can only create issues and PRs. The author merges manually, then CI packages and deploys to an app server VM.
- How it went
- The source gives no measured results. It describes the setup as overkill but worth it to cut the risk of personal data exfiltration. Dev mode can still expose some secrets locally.
- Worth knowing
- In local dev mode the agent may still see secrets, so the Infisical protection only fully holds outside that mode.
Try it yourself with Claude Code
Help me set up a locked-down virtual machine for running you on my project [repo name]. Give it only the permissions it needs: reading the code, getting secrets from [secrets manager], and opening issues and pull requests on [Git host], with no ability to merge. Walk me through the setup step by step, and finish by having it open a small test pull request. Pause and show me each command that changes my system or credentials before you run it.
Want help getting this working? Join the Vibe Coding Academy ↗ Run by Alex Finn, who also runs this site.
Source: HN · Oct 20, 2026
Related use cases
Turn tickets into merged pull requests
Pulls tasks from GitHub Issues or Linear, then runs Claude Code or Codex in isolated Kubernetes pods to carry each one through to a PR.
Build a personal tax refund calculator instead of paying a CPA
A user had Claude Code build an interactive tax calculator using 2025 tables to avoid a $300 CPA fee.
Take ideas to implementation with a planning-command pipeline
A solo SaaS founder uses a custom five-command agent flow (intent, impact analysis, planning, execution, review) with lint guardrails to ship features in a production product.
Build a C compiler with a team of parallel agents
Anthropic's engineering write-up on tasking Opus 4.6 agent teams with building a C compiler.
Reverse engineer legacy systems without source code
Thoughtworks consultants used Gemini 2.5 Pro in a two-week pilot to produce validated blueprints of legacy systems' functionality.
Audit a feature's issues and hand them to an engineer's agent
An AI agent listed all issues with a feature and sent them to an engineer, whose own agent then addressed most of them automatically.
Custom agent
Get 5 like this every morning
The best things people got an AI agent to do, each with the prompt to try it.