mkenv creates disposable Docker containers for your project. No port mapping — ports bind dynamically. No host.docker.internal — localhost just works. No Dockerfile to write — mkenv auto-detects your stack. Sensitive paths like ~/.ssh and ~/.aws are blocked from mounting.
mkenv.shcd ~/projects/myapp && mkenv .Your npm install, pip install, LLM agents, and builds run isolated. Your credentials stay on your host.
Every time we talk security and isolation we mean tradeoffs:
host.docker.internal. Your scripts break. Your configs break. Your muscle memory breaks.Every developer understands they need isolation. But every day, when it's time to actually set it up, your brain screams "not today." So you run npm install on your host machine. Again.
We postpone security until something breaks. That's human nature.
Risk isn't hypothetical:
Security always comes with a cost — configuration, changed workflows, things that break. mkenv aims to pay that cost for you. It's a CLI that generates hardened Docker environments from your project, handling security configuration, port forwarding, and path blocking so you don't have to.
mkenv gives you:
npm install run inside the sandbox, not on your host.host.docker.internal. Just use localhost as always.Run npm run dev inside the sandbox, access it at localhost:3000 in your browser. Run Postgres on your host, access it at localhost:5432 from inside. Bidirectional, on-demand, no configuration. How it works →
Your workstation runs only Docker, a browser, and the mkenv binary. All dev tools, runtimes, and dependencies stay inside the container.
vs Devcontainers: No Dockerfile or devcontainer.json to write. Ports bind dynamically without configuration. Security guardrails are built-in — you can't accidentally mount ~/.ssh even if you try.
vs plain Docker: With Docker you build and maintain your environment from scratch, learning security quirks along the way. mkenv auto-detects your project, handles port forwarding bidirectionally, and bakes in security defaults. No Dockerfile to write or maintain.
vs Nix/Devbox: Those manage your toolchain but run code on your host. mkenv runs everything in a container — actual isolation, not just reproducibility.
vs all of them: mkenv has a policy engine. Developers are protected from accidental mistakes (mounting credentials, exposing dangerous ports). Teams can enforce their own rules. None of the alternatives have this built-in.
Audit trail: mkenv logs everything — network connections, port bindings, package installs, system changes. Full audit trail stored locally. When something goes wrong, you know exactly what happened.
Most projects need zero configuration — mkenv auto-detects your stack. When you do need to customize, we keep it minimal. No new DSL to learn, no 500-line YAML files.
Customize project defaults without repeating command-line flags. Place .mkenv files in your project root or parent directories for multi-project settings.
Bricks are atomic building blocks that mkenv uses to generate your environment — things like claude-code, nvim, node, go.
{
"enabled_bricks": ["claude", "nvim"],
"volumes": ["~/data:/data"]
}Enforce security policies using policy.json. Control which tools can be used, restrict mount paths, and manage port access.
{
"disabled_bricks": ["codex"],
"allowed_project_path": "/home/user/projects",
"reverse_proxy": {
"denied_ports": [5432, 3306]
}
}Policy files use read-only permissions (chmod 444) to prevent unauthorized modification.
See the full documentation for commands, bricks, troubleshooting, and advanced features.
Prerequisites: Docker Desktop or Docker Engine must be installed and running
brew tap 0xa1bed0/mkenv
brew install mkenvcd /path/to/your/project
mkenv .mkenv will analyze your project, build a container, and drop you inside. Subsequent runs reuse cached dependencies.
mkenv is released under the Elastic License 2.0 (ELv2)
You can: Use mkenv for personal projects, at work, across your company, in CI pipelines, and modify it for internal use.
You cannot: Resell mkenv, offer it as a hosted service (SaaS), or build a competing product from it.
ELv2 keeps mkenv free for developers while preventing commercial exploitation.
We're not a big corporation or Security Enterprise Platform™.
We're developers who got burned by supply chain attacks and built the tool we wish we had.
If you've been thinking "I should really isolate my dev environment but it's too much work" — this is for you.