Lyngvi 2.0.0, released under the MIT license, introduces a hardened, agent-agnostic sandbox for running autonomous coding agents against local repositories. Built for macOS and Linux using Podman 5+, the tool isolates agent sessions into individual containers with no default network route. The architecture ensures that while agents receive a working copy and toolchain, they never access your credentials, git history, or the broader internet without explicit allowlisting.

Structural Isolation Over Policy

The core premise of Lyngvi is that boundaries should be architectural, not just policy-based. Each conversation spawns a single container that sits on an internal network, forcing all outbound traffic through a Squid proxy. This proxy evaluates a blocklist first, targeting known exfiltration endpoints like webhook.site, pastebin.com, and ngrok.io, before checking an allowlist. If a hostname matches neither, the request is denied at the proxy level, preventing silent data leaks to your firewall.

Credential and Git Hygiene

Agents work within a copied directory featuring a fresh .git folder, stripping out hooks, config, remotes, and credential helpers. Secrets are managed via a gateway sidecar that holds tokens in a locked upstream object, meaning the agent only sees a hostname and receives a 403 error for unauthorized requests. This design ensures that plugins cannot read sensitive tokens, and the runtime injects credentials only when necessary, keeping them out of the container environment entirely.

Controlled Delivery Workflow

Changes are never committed silently to main. Instead, Lyngvi generates a patch inside the container that is classified on the host into three buckets: apply, hold, or reject. Ordinary text changes can be applied after review, while executables, binaries, and path traversals are held back or rejected automatically. The delivery process requires human approval for each file, and protected branches are structurally refused to prevent accidental pushes to production branches.

Key Takeaways

  • Zero Direct Egress: Session containers have no default route; all traffic goes through a Squid proxy with strict allowlists.
  • Git Sanitization: Agents receive a copy with a fresh .git, removing hooks, remotes, and credential helpers from the attack surface.
  • Secret Gateway: Credentials are held in a sidecar, ensuring agents never see tokens, only hostnames.
  • Human-in-the-Loop Delivery: Changes are classified as apply, hold, or reject, requiring explicit approval before committing to a working branch.
  • Agent Agnostic: Supports Claude Code, OpenCode, and custom agents via simple JSON adapters, with local model support through the proxy.

The Bottom Line

Lyngvi treats AI agents like untrusted third-party contractors: they get a workspace, but not the keys to the kingdom. By enforcing hard structural boundaries rather than relying on agent compliance, it solves the most persistent security headache in agentic codingβ€”data exfiltration.