Running AI agents

Coding agents like Claude Code and Codex do their best work when they don't stop to ask before every command. On your own Mac, that means trusting them with your files, your keys and your network. In a Hangar VM an agent gets a whole machine to itself, you decide which hosts it can reach, and a snapshot puts everything back.

1. Create a VM

The examples call the VM kestrel; any name works.

Hangar's macOS base image comes with the Command Line Tools, Homebrew and Hangar's agent, and the administrator admin with the password admin:

hangar create kestrel --os macos --image base

Linux works just as well, from a cloud image:

hangar create kestrel --os linux --user dev --disk-image https://cloud.debian.org/images/cloud/trixie/latest/debian-13-genericcloud-arm64.tar.xz

2. Let it reach only what it needs

Pick a template on the Policies page, such as Claude Code or Codex, or build your own. Then import it in the app: the VM's Traffic tab, Rules File, Import… › Import from URL…

Or set the rules from the command line:

hangar policy kestrel --mode allowlist --allow anthropic.com --allow claude.ai --allow claude.com --allow github.com --allow npmjs.org

Rules apply to a running VM at once. Everything else is blocked, and shows up as blocked in the VM's traffic.

Install what the agent needs, like Homebrew packages, before you switch the allow list on, or add those hosts to it too.

3. Share its project, and nothing else

hangar share add kestrel ~/Code/my-project

It appears in the VM under /Volumes/My Shared Files on macOS, or /mnt/hangar on Linux. A shared folder is read-write unless you add --read-only, so the agent's changes land in the folder on your Mac. To keep your copy untouched, clone the repository inside the VM instead.

Leave Use Shared Clipboard off, the default, for a VM you don't trust.

4. Take a snapshot

hangar snapshot take kestrel clean

5. Start it and let the agent work

hangar run kestrel --background
ssh admin@$(hangar ip kestrel --wait 60)

Inside, install your agent the way its docs describe and start it. With approvals off it works on its own, and the worst it can break is this VM.

6. Watch it

hangar traffic kestrel --follow

If it reaches for something it shouldn't, cut it off at once:

hangar policy kestrel --isolate on

Isolate cuts the VM off from everything but this Mac. The shared clipboard and shared folders still work.

7. Roll it back

When the run is done, stop the VM and put it back to the snapshot:

hangar stop kestrel
hangar snapshot restore kestrel clean

Everything since the snapshot is lost, unless you take another snapshot first.

Many agents at once

Clone the clean snapshot into as many VMs as your Mac can hold:

hangar clone kestrel kestrel-2 --snapshot clean
hangar clone kestrel kestrel-3 --snapshot clean

Each clone starts fresh, with its own MAC address, IP address and machine identity, while the source keeps running. Check a clone's rules with hangar policy kestrel-2.