stoat gives coding agents sandboxed QEMU VMs with snapshots via MCP
Bright-Fun-1638 · reddit · 2026-09-12
- After an errant rm and a broken package manager from running coding agents directly on his machine, the author found containers insufficient: they fail once a guest needs systemd, kernel modules or loopback, and share his kernel anyway.
- VirtualBox/VMware expose nothing an agent can call, so the working setup drives QEMU directly, defines VMs in TOML, and scopes one MCP server per guest — giving the agent exec, files, packages, ports, services, logs and snapshots inside the VM.
- Two must-haves: per-VM access levels (none to exec) so "give the agent a VM" never becomes "give the agent every VM", and snapshots (stoat snapshot / stoat restore) to roll back risky operations.
- Local VMs need Linux with KVM; macOS/Windows fall back to a slower, paid remote GCE path. Go binary on GitHub, AGPL-3.0: NovusEdge/stoat.
Related event: stoat: A Single Go Binary Giving Agents Snapshot-Isolated QEMU VMs(2 posts)→
More from coding & agent
- Models already understand harnesses: a minimal agent harness takes hours, but customization still needs you — omarsar0 · 2026-10-31
- krishnan on autonomous lab agents: criticism changed the next search, not just verdicts — krishnan · 2026-10-31
- krishnan proposes logging ruled-out troubleshooting hypotheses for future reopening — krishnan · 2026-10-31
- PI agent rejected 75 proposals in 30 hours; manager banned recurring bad ideas — krishnan · 2026-10-31
- Multi-agent AI lab autonomously researches quantum spins in diamond, revises drifting experiments — krishnan · 2026-10-31
- Build your own agent harness: omarsar argues vendor harnesses will quietly constrain users — dair_ai · 2026-10-31