Chainguard Workspaces: coding agents in microVMs, keys kept out

Your coding agent runs with your permissions, on your laptop, next to your cloud keys. Chainguard Workspaces is a bet that it should not. Chainguard announced the beta on October 14: each developer or AI coding agent gets its own remote, hardened Linux microVM, and the real credentials never go inside it. This is the right shape for agent security, whether or not you buy this product.

What actually happened

Per Chainguard's launch post and product page:

• The sandbox. Workspaces are remote microVMs built on Chainguard's hardened images. You open one with chainctl develop. Your local working tree syncs in, so you keep your editor and Git flow while code runs somewhere else.
• The credentials. Chainguard says no secrets live on disk or in memory inside the microVM. A host-side proxy checks each outbound request and injects short-lived credentials in transit. Tools that need a key on disk get an encrypted stand-in that does not work outside the session.
• The network. An optional egress policy blocks and logs any outbound request to an endpoint you have not allowed.
• Parallel runs. The --fresh flag starts separate Workspaces for the same repo, so agents can try different approaches side by side.
• Status and price. Open beta with a free 30-day trial. Pricing is based on compute used; Chainguard has not published rates. Claude is the supported agent today, with more planned. It is a technology preview, so not for production yet.

Why it matters for your business

Most agent incidents we read about are not clever. An agent finds a key it should not see, uses it, and does something nobody approved. Prompt rules and allowlists help, but a key that is on the box can still be read. A key that is not on the box cannot.

That is the pattern to copy, with or without Chainguard:

• Get long-lived keys off dev machines. If an agent can read ~/.aws, .env, or a token file, assume it will one day.
• Use short-lived, scoped credentials. Issue tokens per task, with a short expiry and the smallest scope that works.
• Control egress. Default-deny outbound traffic for agent runs. Log what gets blocked; that log is your early warning.
• Separate the agent from the human. The agent should not inherit everything the developer can touch.

If you trial Workspaces, test the egress policy and credential proxy against your real toolchain first. That is where hosted sandboxes break.

Sources: Chainguard: Introducing Chainguard Workspaces, Chainguard Workspaces product page.