Vivarium

Vivarium - Containerized environment for coding agents

Ready-to-use Docker environment for coding agents, with rootless isolation and a broad software-development toolchain.

Vivarium started from a simple problem: coding agents need broad permissions to be useful in a fully automated way, but I do not want them working across my whole computer given the many security issues arising from that. So I built this Docker-based workspace (and microVM perhaps later) where I can run a local agent against one repository at a time. Only that repository is mounted by default; the rest of my files stay outside the container. The image runs on Wolfi Linux and includes the things I usually need: Go, Python, Node.js, Zig,compilers, test runners, linters, Git tooling, container and supply-chain utilities, documentation tools, and a few agent helpers.  Build flags let me omit or add tools like Rust and Semgrep when a project needs them. The default just recipes require a rootless Docker daemon, and the container drops all Linux capabilities and blocks privilege escalation. It is not a magic security box - agents can still change anything I mount and network access remains enabled - but it gives them a much smaller blast radius than running directly on my machine. I also built a small utility called keeper . It prints the installed OS package manifest, checks the toolchain and mount permissions, and launches whichever agent I want to use. I now use Vivarium daily to give local coding agents a complete development setup without handing them my entire workstation.

Open source project · 2026 · Author