If you have been keeping an eye on the developer space over the last few weeks, you’ve likely noticed a massive shift in how we talk about AI coding assistants. We are rapidly moving past the era of simple chat interfaces and inline completions. We are now firmly in the era of agentic developer tools—AI agents that don't just suggest code, but actually run tests, debug build failures, navigate directories, and commit changes.
Anthropic’s recent release of Claude Code (the CLI tool powered by Claude 3.7 Sonnet) is a prime example of this evolution. It is incredibly powerful, fast, and eerily good at managing local repositories. But it also introduces a massive security paradigm shift. When you run claude-code, you are giving an LLM-driven agent the ability to execute terminal commands, install npm packages, modify configurations, and interact with your filesystem.
Are you comfortable running that directly on your primary work machine containing your production SSH keys, active cloud credentials, and sensitive client data? Probably not. While containerization and virtual machines are great, they often lack the seamless access to hardware, local compilers, and USB peripherals that real-world development requires. Today, we are going to walk through how to resurrect a spare Mac (or a cheap Mac Mini) as a dedicated, isolated hardware sandbox specifically designed for Claude Code to control safely.
Why Dedicated Hardware Over a Local Docker Container?
Before we dive into the terminal, let’s address the elephant in the room: Why not just run Claude in a Docker container?
Docker is fantastic for sandboxing applications, but it introduces friction for a general-purpose AI agent. Many development workflows require testing native desktop builds, interacting with system-level APIs, running complex virtualization (like iOS simulators or Android emulators), or accessing specific hardware. Furthermore, containerized environments often lack the performance of bare metal, especially when compiling large codebases or running local test suites.
By using a dedicated "burner" Mac, you get:
- Physical Isolation: Your primary development machine, containing your primary GPG/SSH keys, password manager, and active browser sessions, remains completely isolated from the agent's execution environment.
- Bare-Metal Performance: Claude Code has full access to the Mac's CPU, GPU, and RAM, allowing fast builds and zero-overhead containerization if the agent itself needs to spin up Docker.
- Safe Automation: If the agent accidentally runs a destructive command (like a poorly scoped
rm -rf), it only destroys a transient sandbox environment that we can restore in minutes.
The Architecture: The Dual-Machine Setup
Our goal is to create a secure, seamless workflow where you can write code on your primary machine, but delegate heavy lifting, testing, and agentic refactoring to the spare Mac. Here is how the flow looks:
+--------------------------+ +--------------------------+ | Primary Work Machine | | Dedicated Spare Mac | | | | | | - IDE / Git Client | SSH (Key) | - isolated-user account | | - Private SSH Keys |---------------->| - Claude Code CLI | | - Secret Credentials | | - Safe Sandboxed Repo | +--------------------------+ +--------------------------+
To make this secure, we must ensure that the spare Mac has absolutely no path back to our primary machine, our local network's router configuration, or our primary cloud accounts.
Step 1: Preparing the Spare Mac
First, we need to clean house on the spare Mac. Do not just log into your existing iCloud account and call it a day. We want to treat this machine as hostile territory.
1. Factory Reset and OS Clean Install
Perform a clean install of macOS (Ventura or Sonoma are preferred for modern CLI tool compatibility). When setting up the machine:
- Do NOT sign in with your personal Apple ID. Skip this step entirely.
- Create a dedicated, non-administrator user account specifically for the AI agent (e.g.,
agent-bob). - Enable FileVault encryption during setup to protect the physical drive.
2. Restrict Network Access
If your router supports it, place this spare Mac on an isolated Guest VLAN. It needs outbound internet access to talk to the Anthropic API and fetch dependencies (npm, pip, homebrew), but it should have zero routing capability to your local home network or primary devices.
Step 2: Configuring SSH with Zero-Trust Principles
We will interact with our spare Mac via SSH. However, we want to configure SSH so that the spare Mac cannot exploit the connection to hop back to our host machine.
1. Enable SSH on the Spare Mac
On the spare Mac, go to System Settings > General > Sharing and enable Remote Login. Restrict access only to the specific non-admin user you created (agent-bob).
2. Harden the SSH Daemon Configuration
Open /etc/ssh/sshd_config on the spare Mac and ensure the following directives are set to disable dangerous forwarding behaviors that an agent might exploit:
# Disable password authentication; force cryptographic keys
PasswordAuthentication no
PubkeyAuthentication yes
# Prevent the agent from setting up port forwards back to your network
AllowTcpForwarding no
X11Forwarding no
AllowAgentForwarding no
Restart the SSH daemon to apply changes:
sudo launchctl kickstart -k system/com.openssh.sshd3. Generate a Dedicated SSH Key Pair
On your primary machine, generate a dedicated SSH key specifically for this machine. Do not reuse your default GitHub/GitLab keys.
ssh-keygen -t ed25519 -f ~/.ssh/id_spare_mac -C "primary-to-spare-mac"Copy the public key to the spare Mac's ~/.ssh/authorized_keys file for the agent-bob user.
Step 3: Setting Up the Agent Environment
Now that we can securely SSH into our spare Mac, let's set up the developer environment and install Claude Code. SSH into the spare Mac from your primary machine:
ssh -i ~/.ssh/id_spare_mac agent-bob@<spare-mac-ip>1. Install Essential Developer Tools
Install Homebrew, Node.js, and Git. Since this is an isolated machine, we can install these fresh without worrying about version conflicts with your primary work projects.
# Install Homebrew
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
# Add Homebrew to path (adjust for zsh)
echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> ~/.zprofile
eval "$(/opt/homebrew/bin/brew shellenv)"
# Install Node.js (required for Claude Code) and Git
brew install node git2. Install and Authenticate Claude Code
Now, install the Claude Code CLI tool globally using npm:
npm install -g @anthropic-ai/claude-codeTo authenticate Claude Code, run the initialization command:
claudeThis will prompt you to authorize the CLI with your Anthropic Console account. It will output a one-time code and open a browser window (or give you a URL to open on your primary machine) to complete the OAuth handshake.
Step 4: Creating a Safe Git Loopback
How do we actually write code using this setup? We don't want to clone our proprietary, sensitive corporate Git repositories directly onto this spare Mac if we can avoid it. Instead, we can use a local Git remote setup over our secure SSH connection.
This allows us to push a specific branch of our project from our primary machine to the spare Mac, let Claude Code do its agentic magic (compile, run tests, fix bugs, commit), and then pull the clean commits back to our primary machine for review.
On the Spare Mac:
Create a bare Git repository to act as the sync point, and a working directory where Claude will actually run.
mkdir -p ~/projects/my-app.git
mkdir -p ~/projects/my-app-worktree
# Initialize the bare repo
cd ~/projects/my-app.git
git init --bareOn your Primary Machine:
Add the spare Mac as a Git remote in your active project directory:
git remote add sandbox agent-bob@<spare-mac-ip>:projects/my-app.gitNow, push your current development branch to the sandbox:
git push sandbox mainBack on the Spare Mac (Automated Workspace Setup):
To prevent Claude from messing up the bare repository, we configure the working tree to pull from the bare repository locally.
cd ~/projects/my-app-worktree
git clone ~/projects/my-app.git .Step 5: Letting Claude Code Loose
You are now ready to unleash the agent. Navigate to the working directory on the spare Mac and start Claude Code:
cd ~/projects/my-app-worktree
claudeYou will be greeted by the Claude Code interactive prompt. Because Claude has full access to the terminal within this folder, you can give it complex, multi-step engineering tasks:
Claude > Run the test suite. If any tests fail, inspect the codebase, fix the bugs, ensure the tests pass, and commit the changes with a descriptive message.Watch as Claude automatically runs your test runner (e.g., npm test or pytest), reads the stack traces, opens the offending files, edits them, and runs the tests again until they pass. Once it is finished, it will write a clean Git commit.
Once Claude is done, go back to your primary machine and pull those commits back down to inspect them:
git pull sandbox mainYou can now safely review the code changes and test results on your primary IDE before merging them into your main upstream branch (e.g., on GitHub).
Conclusion: The Future of Isolated Agentic Workflows
As AI agents move from novelties to standard components of a developer's daily workflow, security cannot be an afterthought. Running autonomous agents on bare metal gives them the performance and system access they need to be genuinely useful, but using a dedicated, isolated hardware sandbox like a spare Mac ensures your critical credentials and systems remain entirely safe.
By spending an hour setting up a dedicated hardware playground, you get the best of both worlds: the cutting-edge speed of Claude 3.7 Sonnet executing commands on native hardware, and the peace of mind that comes with physical isolation.
Have you tried Claude Code yet? What kind of tasks are you delegating to agentic CLI tools, and how are you keeping your development environment secure? Let me know in the comments below, or share your setup on Twitter/X by tagging @sysseder!