Can Claude Code read my Mac's files from inside a Kyvenza VM?

Not unless you add a shared folder. A new Kyvenza VM has its own virtual disk and no shared folders, so Claude Code inside the guest sees only the guest's filesystem. If you do share a folder, share one project directory and switch on Read Only unless the agent must write to it.

Does the VM need internet access to run Claude Code?

Yes. Claude Code calls Anthropic's API, so the VM needs the default Shared (NAT) network mode. The Isolated mode cuts the guest off from the network entirely, which also cuts Claude Code off from the model.

Is it safe to use --dangerously-skip-permissions inside the VM?

It is far less risky inside a disposable VM than on your Mac, because the worst case is a broken guest you can restore from a snapshot. It still lets the agent use whatever credentials and network access the VM has, so keep those to the minimum the task needs.

Do I need Docker to sandbox Claude Code on a Mac?

No. A full Linux VM is a stronger boundary than a container that shares Docker Desktop's Linux environment, and Kyvenza creates it through a GUI. You can still install Docker inside the VM if your project needs it.

Run Claude Code in an isolated VM on a Mac

To run Claude Code in an isolated VM on a Mac, create a Linux ARM virtual machine, install Claude Code inside the guest, and keep your Mac's files out of it. Kyvenza does the VM part through a GUI on Apple Silicon: no Docker, no QEMU flags, and a snapshot you can roll back to when the agent breaks something.

Claude Code's own permission prompts decide what the agent may do. A VM decides what it can reach. This guide sets up the second so you can relax the first.

When a VM is the right sandbox for Claude Code

Use this workflow when:

You want to let Claude Code run commands with fewer approval prompts, including --dangerously-skip-permissions, without risking your home directory, SSH keys, Keychain, or browser profile.
The project installs packages, runs build scripts, or pulls dependencies you have not reviewed.
You want a clean, repeatable machine per project or per client, and the ability to throw it away.
You prefer a GUI app over assembling Lima, Docker, and shell scripts.

A VM is not needed for every session. For reading code or small edits in a trusted repository, Claude Code's built-in permission modes on the host are usually enough.

This guide runs Claude Code inside the VM. If instead you want Claude Code on your Mac to drive VMs (start, snapshot, run commands in them), see MCP server for Mac VMs.

Requirements

On the Mac:

An Apple Silicon Mac (M1 or later) running macOS 14 Sonoma or later. See System requirements.
Kyvenza installed, with an active 7-day trial or a license. Neither caps how many VMs you create. See Licensing.
About 30 GB of free disk for the guest, plus room for your project and its dependencies.

Inside the VM:

An arm64 Linux distribution. This guide uses Ubuntu; Debian and Fedora work the same way.
Internet access, because Claude Code calls Anthropic's API.
A Claude subscription or an Anthropic Console account to sign in with.

Create the Linux VM

Open Kyvenza and click + in the toolbar.
Choose Linux, then Ubuntu.
Name the VM after its job, for example claude-sandbox.
Give it at least 4 vCPUs, 8192 MB of memory, and 64 GB of disk. Language servers, test suites, and package installs use more than you expect.
Leave Shared Folders empty for now.
Review and click Create VM.

Kyvenza downloads the current arm64 installer and attaches it on first boot. Install Ubuntu in the VM window, shut the guest down, and start it again. If the installer reappears, mark the installation as complete in the VM's detail view before the next boot. The general flow is in Create your first VM.

Take a clean snapshot

Before Claude Code touches anything, stop the VM, open its Snapshots section, and click Take Snapshot. Name it something like clean-ubuntu.

This is the point you return to with Restore when the guest gets into a state you do not want to debug. Take another snapshot after you install your toolchain, so a restore does not mean reinstalling everything.

If you want several sandboxes from the same baseline, clone the VM instead of repeating the install. See Managing VMs.

Install Claude Code in the guest

Open a terminal inside the VM and install Claude Code with Anthropic's native installer:

bash

curl -fsSL https://claude.ai/install.sh | bash

Then install whatever your project needs (Git, a language runtime, build tools) and clone the repository inside the guest:

bash

sudo apt update && sudo apt install -y git build-essential
git clone https://github.com/you/your-project.git
cd your-project
claude

The first run asks you to sign in. Follow the link it prints. Check Anthropic's Claude Code setup docs for the current install options and system requirements before scripting this.

Keep the boundary tight

The VM only isolates what you leave out of it.

Shared folders. A new VM has none, so the guest cannot see your Mac's files. If you need one, add a single project folder and switch on Read Only unless Claude Code must write to it. Never share your home folder, ~/.ssh, or a folder with other clients' code. Linux guests mount shared folders with a virtiofs tag; the VM's detail view shows it.
Credentials. Give the VM only what the task needs: a deploy key scoped to one repository instead of your personal SSH key, a scoped token instead of your main cloud credentials.
Network. Keep the default Shared (NAT) mode. The guest reaches the internet but devices on your network cannot connect to it. Isolated removes network access entirely, which also stops Claude Code from reaching the model. See Networking.
One VM per trust level. Do not mix a client's repository with personal experiments in the same guest.

With those in place, running claude --dangerously-skip-permissions inside the VM is a reasonable trade: the worst outcome is a guest you restore from a snapshot. The agent can still use any credential or network access you gave the VM.

What Kyvenza does not support

Intel Macs, and x86_64 Linux images. Use the arm64 build of your distribution.
Nested virtualization, so you cannot run another VM inside the guest.
GPU passthrough. Local model inference inside the guest runs on the CPU.
USB device passthrough.
Bridged networking in the Mac App Store build. The direct download build offers it for Linux guests; this workflow does not need it.

How it compares

Option	Boundary	Setup
Claude Code permission modes on the Mac	Rules inside the agent; same user account and files	None
A second macOS user account	Separate home folder; same OS, same Mac	Minutes; you switch users to work
Docker or a dev container	Container on a shared Linux VM	Dockerfile and mounts to maintain
Linux VM in Kyvenza	Separate kernel, disk, and network stack	GUI; one-time OS install
A dedicated Mac mini or cloud machine	Separate hardware	Most expensive and slowest to reset

UTM and VMware Fusion can host the same Linux VM for free. Kyvenza is a better fit when you want snapshots and clones in a Mac-native GUI, or want Claude Code on your Mac to manage the sandboxes through the built-in MCP server. For the full comparison, see Run an AI agent safely on a Mac.

Troubleshooting

`claude: command not found` after installing

Open a new terminal so your shell picks up the updated PATH, or run source ~/.bashrc.

Claude Code cannot reach the API

Check that the VM's network mode is Shared (NAT), not Isolated, then test from the guest with curl -I https://api.anthropic.com.

Builds run out of memory

Stop the VM, raise its memory in the VM configuration, and start it again.

The VM will not start or behaves unexpectedly

Open Diagnostics & troubleshooting to review recent VM events and free disk space, and export a diagnostics bundle if you need to contact support.

Next steps

Download Kyvenza and start the 7-day trial.
Let Claude Code on your Mac manage these sandboxes through the MCP server.
Read Run OpenClaw in a Linux ARM VM for the same pattern with a long-running agent.

Run Claude Code in an isolated VM on a Mac ​

When a VM is the right sandbox for Claude Code ​

Requirements ​

Create the Linux VM ​

Take a clean snapshot ​

Install Claude Code in the guest ​

Keep the boundary tight ​

What Kyvenza does not support ​

How it compares ​

Troubleshooting ​

claude: command not found after installing ​

Claude Code cannot reach the API ​

Builds run out of memory ​

The VM will not start or behaves unexpectedly ​

Next steps ​