Under the hood
Every project you open in Speedwave runs inside its own set of containers, sitting inside a small Linux virtual machine. You don’t manage any of this by hand. This section is for readers who want to see how the pieces connect: which container talks to which, where the VM sits, and how images get built.
At the center is the container that runs Claude Code. It has no way to start or control other containers, and no access to the container engine socket. If you sign in with your Anthropic subscription (OAuth), it holds no service token either: the proxy forwards your login session’s authorization header untouched. If you authenticate with an Anthropic API key instead, that key is injected into the Claude container directly so /model aliases and long-context mode keep working, a deliberate exception to routing every other provider’s key through the proxy. Either way, the Claude container reaches exactly two things: the Speedwave proxy, which forwards LLM traffic to your chosen provider, and the MCP Hub, which routes tool calls out to one worker container per connected integration. Each worker holds only its own service’s credential, read-only, and nothing else on the network can see it.
flowchart TB
subgraph VM["Linux VM (Lima on macOS / WSL2 on Windows)"]
subgraph NET["Per-project container network"]
Claude["Claude container<br/>no socket, token only with API key auth"]
Proxy["Speedwave proxy<br/>LLM traffic"]
Hub["MCP Hub<br/>zero tokens"]
W1["Integration worker<br/>own credential, read-only"]
W2["Integration worker<br/>own credential, read-only"]
Claude --> Proxy
Claude --> Hub
Hub --> W1
Hub --> W2
end
end
That whole set, the Claude container, the proxy, the hub, and every worker, lives on a dedicated network per project, so two projects never share a network or see each other’s containers. The full container list, what each one mounts, and how Speedwave sizes the VM on macOS and Windows is in Container topology.
The credential boundaries sketched above are the same ones enforced at the security layer: read Isolation for how the Claude container’s socket isolation is kept and verified, and what changes when you authenticate with an API key instead of OAuth.