Reverse Engineering Claude Code: 10GB Ubuntu ARM64 VM and vsock RPC
foxtrot_north · reddit · 2026-07-06
A developer deconstructed the 10GB VM image within the Claude Code application's support folder, discovering that it eschews containers or Seatbelt sandboxing. Instead, it utilizes Apple's Virtualization.framework to boot a complete Ubuntu ARM64 cloud image. The control plane is managed by the daemon coworkd (internally sdk-daemon), which communicates with the host via vsock RPC and runs with root privileges; outbound network traffic is handled through a gVisor user-space network stack. The disk architecture employs a compressed golden image paired with a disposable, per-session overlay layer that automatically resets upon each boot to ensure isolation. The author has published a comprehensive technical analysis on Substack.
More from coding & agent
- Is inference latency becoming the biggest bottleneck for production AI agents? — Euphoric_Sea632 · 2026-09-11
- Anthropic researcher: 99% of engineers now run swarms of 300+ self-improving agents — AlishaOutridge · 2026-09-11
- Gergely Orosz: Shipping 10x PRs With AI Agents, Sites Fill With Small Regressions — ducha_aiki · 2026-09-11
- Same Echo Maze prompt, three frontier models: all passed visually but shipped the same hidden bug — eyishazyer · 2026-09-11
- Astra storyboards plus Minimax H3 per-shot generation boost video success rates — Hailuo_AI · 2026-09-11
- Codex tip: use Sol with Astra and Luna sub-agents to save usage — pvncher · 2026-09-11