4 ms·

I see. I was intending to use a container to sandbox npm/yarn, it sounds like that is pointless. npm scares me - if there is a way to sandbox it on a mac, I'd

by dunham 2y ago

I see. I was intending to use a container to sandbox npm/yarn, it sounds like that is pointless. npm scares me - if there is a way to sandbox it on a mac, I'd like to know.

retsl 2y ago
Containers on MacOS are ran inside a Linux VM. If you ensure that the Linux VM doesn't have access to anything besides the required files/networks, that should be pretty secure. Best case you go through the settings of Docker, Podman or whatever you use to limit integrations. Then, from within the VM and container see what networks, files, etc. you can reach to be sure.
- regularfry 2y ago
  I think in context the challenge here is to use remote editing to treat the container as a VSCode remote. As shown, that's not enough of a sandbox because the agent gives a route out.
mdaniel 2y ago
macOS has a formal sandboxing language; I first learned about it via iTerm2's build process: https://gitlab.com/gnachman/iterm2/-/blob/v3.5.12beta2/deps.sb https://gitlab.com/gnachman/iterm2/-/blob/v3.5.12beta2/deps.... consumed by /usr/bin/sandbox-exec https://gitlab.com/gnachman/iterm2/-/blob/v3.5.12beta2/Makefile#L174 https://gitlab.com/gnachman/iterm2/-/blob/v3.5.12beta2/Makef... I haven't tried to use it in anger, but I believe this is the likely starting point https://developer.apple.com/documentation/xcode/configuring-the-macos-app-sandbox https://developer.apple.com/documentation/xcode/configuring-...
- dunham 2y ago
  I've attempted to use the sandbox-exec utility, but didn't have the stamina to get a working sandbox file written. In general, I'd like to be able to sandbox more things. I'm using the app store version of slack because slack doesn't really need access to all of my files.
raggi 2y ago
deno has been somewhat pleasing in this space, it's not a perfect boundary though

4 ms·

I see. I was intending to use a container to sandbox npm/yarn, it sounds like that is pointless. npm scares me - if there is a way to sandbox it on a mac, I'd

by dunham 2y ago

I see. I was intending to use a container to sandbox npm/yarn, it sounds like that is pointless. npm scares me - if there is a way to sandbox it on a mac, I'd like to know.

retsl 2y ago
Containers on MacOS are ran inside a Linux VM. If you ensure that the Linux VM doesn't have access to anything besides the required files/networks, that should be pretty secure. Best case you go through the settings of Docker, Podman or whatever you use to limit integrations. Then, from within the VM and container see what networks, files, etc. you can reach to be sure.
- regularfry 2y ago
  I think in context the challenge here is to use remote editing to treat the container as a VSCode remote. As shown, that's not enough of a sandbox because the agent gives a route out.
mdaniel 2y ago
macOS has a formal sandboxing language; I first learned about it via iTerm2's build process: https://gitlab.com/gnachman/iterm2/-/blob/v3.5.12beta2/deps.sb https://gitlab.com/gnachman/iterm2/-/blob/v3.5.12beta2/deps.... consumed by /usr/bin/sandbox-exec https://gitlab.com/gnachman/iterm2/-/blob/v3.5.12beta2/Makefile#L174 https://gitlab.com/gnachman/iterm2/-/blob/v3.5.12beta2/Makef... I haven't tried to use it in anger, but I believe this is the likely starting point https://developer.apple.com/documentation/xcode/configuring-the-macos-app-sandbox https://developer.apple.com/documentation/xcode/configuring-...
- dunham 2y ago
  I've attempted to use the sandbox-exec utility, but didn't have the stamina to get a working sandbox file written. In general, I'd like to be able to sandbox more things. I'm using the app store version of slack because slack doesn't really need access to all of my files.
raggi 2y ago
deno has been somewhat pleasing in this space, it's not a perfect boundary though