veil
GitHub

veil

Run an AI coding tool in a sandbox, so the tool's vendor does not see your home IP address and the tool only sees the files you choose.

Read the docs View on GitHub

Experimental Status: experimental. This is not an anonymity tool, and it has not had an external security review. Read the threat model and the known limitations before you rely on it.

The problem, and what veil does

The problem

AI coding tools, such as OpenCode, send your prompts and code to their vendor's servers. Every request also tells the vendor your home IP address. Your IP address can point to where you live.

What veil does

veil runs the tool in a sandbox that can see only one project folder and has no network of its own. In the gateway profile, its only way out is a proxy that you host. The proxy sends the traffic through Cloudflare WARP, so the vendor sees a Cloudflare address instead of yours.

How your traffic flows

Network flow of veil in the gateway profile The tool talks to a bridge inside the sandbox. The bridge forwards through a unix socket to veil on the host. veil connects over TCP to the gateway, where Privoxy checks the allowlist, wireproxy carries the traffic into the Cloudflare WARP tunnel, and WARP sends it to the vendor. The same steps are listed as text next to the diagram. Sandbox (bubblewrap, no network) AI tool uses HTTPS_PROXY In-sandbox bridge veil at 127.0.0.1:8118 Unix socket /run/veil/proxy.sock veil on the host connects over TCP Gateway (Docker on your LAN) Privoxy: domain allowlist wireproxy (SOCKS5) Cloudflare WARP tunnel Tool vendor sees a Cloudflare address

Text version of the diagram:

  1. The AI tool runs inside the sandbox and sends its traffic to the proxy named in HTTPS_PROXY.
  2. A copy of veil inside the sandbox, the bridge, listens on 127.0.0.1:8118.
  3. The bridge forwards the traffic through a unix socket, /run/veil/proxy.sock.
  4. veil on the host receives it and opens a TCP connection to the gateway.
  5. On the gateway, Privoxy allows only the listed domains, wireproxy carries them into the Cloudflare WARP tunnel, and WARP sends them to the vendor.

What you get

  • A sandbox for the tool

    On Linux, veil uses bubblewrap to unshare all namespaces and clear the environment. It mounts one workspace read-write at /workspace, and an empty or dedicated HOME.

  • An allowlisting gateway through WARP

    A Docker Compose stack on your local network allows only the domains you list and sends them through a Cloudflare WARP tunnel. DNS is resolved inside the tunnel, never by the client.

  • Fails closed

    If the gateway is missing, veil refuses to start the tool. It never falls back to a direct connection.

  • Wraps any CLI

    You run veil run ... -- <tool> when you want the extra privacy. OpenCode is the first tool tested end to end. Any CLI that honors HTTPS_PROXY can work the same way.

Platforms at a glance

  • Linux

    Supported

    With bubblewrap and unprivileged user namespaces. Tested end to end on arm64.

  • macOS

    Planned

    A Seatbelt backend that allows only the local proxy.

  • Windows

    Not supported

    See issue #3.

Platform details

Get started in 3 steps

  1. Install veil

    Build veil from source with Go and check your system with veil doctor.

  2. Set up the gateway

    Start the Docker stack on your local network and test that it allows only the listed domains.

  3. Run a tool

    Wrap OpenCode, or another CLI that honors HTTPS_PROXY, with veil run.

Start the guide