Running an AI coding agent on your local machine means sharing your filesystem, your credentials, and your CPU with code you didn’t write and can’t fully predict. Bastion takes a different approach: isolated Linux VMs purpose-built for background coding agents.
The project, which surfaced on Hacker News as a Show HN, targets a specific problem that’s growing alongside the agent-coding wave — where do you actually run these things safely?
The pitch is narrow and concrete:
- Isolation by default — each agent gets its own Linux VM, not a shared container or your local dev environment
- Background execution — agents run without blocking your terminal or IDE session
- Purpose-built for coding agents — not a generic VM service repurposed with a new landing page
The sandboxing question matters more now than it did six months ago. Tools like Claude Code, OpenCode, and Codex CLI can read files, execute shell commands, and install packages. Most developers run them with broad filesystem access because restricting permissions breaks the workflow. A dedicated VM sidesteps that tradeoff — the agent gets full access to an environment that contains nothing else worth protecting.
NOTE
The project also appears to have an open-source component aimed at deploying virtual computers for background OpenCode agents specifically, suggesting it isn’t locked to a single agent framework.
This sits in a growing category. Bunnyshell documents the coding agent sandbox pattern — ephemeral environments with filesystem access, network policies, and resource limits designed around agent workflows rather than human SSH sessions. E2B and Daytona occupy adjacent territory. Bastion’s bet is that full VMs, not containers, are the right isolation boundary for agents that need to install system packages and run long processes.
Bastion is early-stage and light on public documentation. Worth watching if you’re running coding agents on anything connected to production credentials or sensitive repos — the “just let it run on my laptop” phase of agent tooling won’t last.