ворса^_✻

Run your agents in lightweight VMs on macOS. Super fast containers, with the hardware-level security enforcement of virtual machines. Built-in tmux and workmux integration. Just one command to get started.

Quick Start | About | Installation | Usage | Documentation

Quick Start

$ brew install cboone/bopca/bopca # Install
$ cd ~/Development/my-repo        # Open your repo
$ bopca                           # Run bopca

# A fresh container builds and runs, your repo is mounted
# at its host path, tmux opens, and your agents are ready.

See Usage and Getting Started for more.

About

Why Bopca?

There are many ways to keep your system safe from errant LLMs. This is the way I do it: as simple and lightweight and automatic as possible. bopca integrates with tmux and workmux, so with one command my whole dev environment is loaded and ready to go.

It takes advantage of macOS 26's enhancements to the Virtualization framework and the Containerization package. An optimized Linux kernel with a lightweight init system allow for sub-second startups. bopca adds to that with customizable containers and great defaults, easy configuration, and tools to help you manage your containers.

The container mirrors your host filesystem layout: your workspace is mounted at its actual host path, and HOME inside the container matches your host HOME. This means your workmux configs, tool settings, and muscle memory all work unchanged. Both Claude Code and OpenCode are always installed and ready to use.

Built-in gitleaks secret scanning prevents you from accidentally sharing secrets from your computer into the container. When secrets are found, an interactive wizard walks you through each finding so you can allow, block, or skip it, and save your decisions to a .gitleaksignore file for future runs.

For parallel development, bopca integrates with workmux to manage multiple worktrees in tmux panes. Run multiple agents in separated worktrees, monitor them all with a comprehensive dashboard, speed up and herd your flock of LLMs. Worktree configuration follows the workmux config chain automatically.

But bopca works great out of the box too, no additional tooling or complicated workflow needed. It works as well with one repo and one LLM as with many repos, many worktrees, and many agents each. Your choice.

Read more about the underlying technology, security benefits, and configurable security levels. Also take a look at the current limitations.

All the docs are available here as well as on bopca.sh. man bopca works too, once it's installed.

Installation + Requirements

You need:

• Apple Silicon
• macOS 26 Tahoe (sorry, Liquid Glass, I know, I know)
• A subscription or API key for Claude Code or OpenCode
• Apple's container tool (either installed automatically by Homebrew or manually by downloading a binary)

Installing, in detail

The easy way

brew install cboone/bopca/bopca

container installs automatically.

The look-ma-no-package-manager way

curl -fsSL https://raw.githubusercontent.com/cboone/bopca/main/scripts/install.sh | sh

The script installs the binary, shell completions, and man pages.

Required: Install container by downloading a binary.

The binary download way

Download the latest release binary from GitHub Releases:

curl -fsSL https://github.com/cboone/bopca/releases/latest/download/bopca-darwin-arm64.tar.gz | tar xz
mv bopca ~/.local/bin/

Required: Install container by downloading a binary.

The go way

go install github.com/cboone/bopca

Required: Install container by downloading a binary.

Note: go install only installs the binary. For shell completions and man pages, see the detailed installation instructions.

The development way

git clone https://github.com/cboone/bopca
cd bopca
make build
cp ./bin/bopca ~/.local/bin

For a full installation including completions and man pages:

make install-all

Usage

Defaults | Configuration | Worktrees | Management commands | Networking

Defaults, one command

$ cd ~/Development/my-repo        # Open your repo
$ bopca                           # Run bopca

The first time you run bopca, it builds your container image (read more about the containers, what they include, and how to customize them), runs it, mounts your repo at its actual host path, and drops you into a tmux session. Both Claude Code and OpenCode are installed and ready -- just run claude or opencode inside the container.

Your home directory paths are mounted into the container too, so your shell config, git config, SSH keys, and agent credentials all work as expected. No setup needed.

This assumes that you're either logged in to your agent subscription account or have an API key set as an environment variable. See Configuration for details on authentication options.

Configuration

For a plain zsh shell instead of tmux:

# .bopca.yaml
shell:
  tmux: false

Configure startup tmux panes for your preferred layout:

# .bopca.yaml
startup_panes:
  - command: ""
    focus: true
  - command: opencode
    split: horizontal
    size: 15

Use YOLO mode to skip agent permission prompts. When enabled, bopca injects shell wrappers in the container so agent commands like claude automatically run with their permission-skipping flags. On first run, bopca asks your preference and remembers it per-repo. Override anytime:

$ bopca --yolo                    # Enable for this run
$ bopca --bardo                   # Disable for this run

See Configuration for all options.

Worktrees with workmux

For multi-agent parallel development with managed worktrees, run workmux inside your bopca tmux session. bopca follows the workmux config chain to resolve your worktree directory automatically -- your .workmux.yaml just works, no path translation needed.

See workmux Integration for detailed setup instructions.

Management commands

bopca build                   # Build the container image
bopca build --rebuild         # Rebuild from scratch
bopca list                    # List running containers
bopca stop                    # Stop your container
bopca clean                   # Remove container images
bopca config                  # Show current configuration
bopca config init             # Create a basic config file
bopca help [command]          # Show help for any command

Networking

Containers are available at DNS hostnames. The host name matches the workspace directory name.

One-time DNS setup:

sudo container system dns create test
container system property set dns.domain test

Once you've done this, bopca will recognize that your system is configured and will make your container available at:

http://my-repo.test

Just make sure your server is listening to the normal ports for what you're doing (443 for https, for example). No port forwarding needed.

See Networking and Configuration for more.

Documentation

Getting Started	Installation, requirements, and first run
About	Project motivations, goals, and design principles
Commands	Full command reference
Configuration	YAML configuration options
Containers	Container details, base image, and pre-installed tools
Development	Development setup and guidelines
Integrations	VSCode integration, workmux, and parallel development
Networking	DNS hostnames and container networking
Roadmap	Future plans and feature roadmap
Security	Security model and secret scanning wizard
Security Levels	Configurable security spectrum from VM baseline to air-gapped sandbox
Technology	Virtualization framework and security benefits
Troubleshooting	Common issues and solutions
Workflows	Common usage patterns and examples

Current Limitations

macOS only: Requires macOS 26 Tahoe on Apple Silicon.

Linux containers only: Apple's Virtualization framework currently only supports Linux containers (not macOS containers).

Networking: Controls over networking are limited, due to the current limitations of the container tool. If you're concerned about exfiltration from your repo, there are manual steps you can take. See Networking: Security for more.

File Issues or create Discussions to share your ideas and let me know about any bugs you've found. Thanks!

Contributions

Contributions are welcome! See DEVELOPMENT and CONTRIBUTING for development setup and guidelines.

What's a Bopca?

In the Dungeon Crawler Carl series, by Matt Dinniman, Bopca Protectors are gnome-like aliens that guard the dungeon safe rooms. Stout, green, hairy, shaggy, and smelling of moss.^✻ (Here's a fan illustration.) This is where I stole the name from. But it turns out there's an even more interesting backstory to it.

The name bopca comes from the word Вӧрса, a forest spirit in Komi mythology. (The Komi peoples have lived in the northeastern-most corner of Europe, at the western edge of the Urals, since at least the first millennium BCE.) It's a Komi word, and since it's written in Cyrillic, it's properly pronounced something like "versa", or [ˈvɘr.sa].

Vorsa is the Komi parallel of the Slavic Leshy. A creature of folktales, they were protectors of the forests, taking the forms of gods, giants, shepherds, animals, mosses, and other forest spirits. Fierce when protecting the forest, benevolent and just with those entering it peacefully.

I am not Komi, nor Slavic. I do not speak any of the relevant languages. I have not even been to that part of the world. This is, therefore, pure cultural appropriation, and all I can say in my defense is that I thought I was appropriating the name of a fictional alien race who really should wash their hands more often.

License

MIT License. TL;DR: Do whatever you want with this software, just keep the copyright notice included. The authors aren't liable if something goes wrong.