3 ms·

Like many people, I suspect, I used Claude to write my own agent sandbox that suits my needs very well. Investing my time in a propietary product has become a h

by outof 2mo ago

Like many people, I suspect, I used Claude to write my own agent sandbox that suits my needs very well. Investing my time in a propietary product has become a hard sell.

zingar 2mo ago
Were you following any patterns/standards/advice on what you needed to protect against? Anything you can point the rest of us to?
- embedding-shape 2mo ago
  You want to prevent the agent/others from reaching your home directory and other things. As long as you don't mount/sync directories/files from/to the container, so no mounting like "-v $(pwd):/app", but instead copy in, then when done, copy out. And of course, instead of doing the "copy in > copy out" process manually, get your local agent to write a bash script that does that for you, given what directory you're in, and you're basically G2G.
  - tjoff 2mo ago
    What is the advantage of copying rather than a bind-mount?
    - furst-blumier 2mo ago
      "Oops I deleted everything under $FOLDER – that mistake is on me" doesn't kill it on your host system
      - tjoff 2mo ago
        Sure, but all projects are version controlled? You only mount the project dir so you can only loose your current changes - which is the same if you copy...
- hvb2 2mo ago
  What specifically are you looking for? If you start from the premise that it runs as you right now, then that's something you can easily improve upon. Start by mounting just your repo and passing in the keys for the agent. Take it from there, it's like software engineering, you iterate. When you run into issues you expand the tools in the container available to it.
- matheusmoreira 2mo ago
  > Were you following any patterns/standards/advice on what you needed to protect against? Just the general knowledge that sharing a kernel with untrusted software is too dangerous, that hardware virtualization is an infinitely smaller attack surface and that the entire industry will be in deep shit if people or AI breaks hypervisors. Initial threat model was supply chain attacks but eventually grew to include AI harnesses as well. Not very worried about them hacking me, more about accident prevention. So that means each VM must be running a completely independent kernel that's fully isolated from the host's file system. They must also have fail closed network filtering built in. > Anything you can point the rest of us to? I have published my virtdev's design document. https://github.com/matheusmoreira/virtdev/blob/master/DESIGN.md https://github.com/matheusmoreira/virtdev/blob/master/DESIGN... Yes, it is AI generated. In summary, it's a QEMU VM orchestrator with a base OS image and project specific delta images. VM lifecycle is managed by systemd. System level isolation is already pretty good and it already solves the "AI wiped out my $HOME" problem. I'm currently working on a custom network stack to replace the nftables based firewall.
KolibriFly 2mo ago
[dead]
matheusmoreira 2mo ago
I did the same thing. It was my first "vibecoded" project. I've been using it every day and it's great. I'm writing a custom Rust network stack for it right now. Gonna replace the current nftables firewall with it. As for Docker Sandboxes, I'll just ask Sol literally right now to see what it does better than my virtdev, and then I'll improve virtdev instead of using Docker.
rvz 2mo ago
Why developers will never pay for their tools.

by outof 2mo ago

Like many people, I suspect, I used Claude to write my own agent sandbox that suits my needs very well. Investing my time in a propietary product has become a hard sell.

zingar 2mo ago

Were you following any patterns/standards/advice on what you needed to protect against? Anything you can point the rest of us to?

embedding-shape 2mo ago
You want to prevent the agent/others from reaching your home directory and other things. As long as you don't mount/sync directories/files from/to the container, so no mounting like "-v $(pwd):/app", but instead copy in, then when done, copy out. And of course, instead of doing the "copy in > copy out" process manually, get your local agent to write a bash script that does that for you, given what directory you're in, and you're basically G2G.
- tjoff 2mo ago
  What is the advantage of copying rather than a bind-mount?
  - furst-blumier 2mo ago
    "Oops I deleted everything under $FOLDER – that mistake is on me" doesn't kill it on your host system
    - tjoff 2mo ago
      Sure, but all projects are version controlled? You only mount the project dir so you can only loose your current changes - which is the same if you copy...
hvb2 2mo ago
What specifically are you looking for? If you start from the premise that it runs as you right now, then that's something you can easily improve upon. Start by mounting just your repo and passing in the keys for the agent. Take it from there, it's like software engineering, you iterate. When you run into issues you expand the tools in the container available to it.
matheusmoreira 2mo ago
> Were you following any patterns/standards/advice on what you needed to protect against? Just the general knowledge that sharing a kernel with untrusted software is too dangerous, that hardware virtualization is an infinitely smaller attack surface and that the entire industry will be in deep shit if people or AI breaks hypervisors. Initial threat model was supply chain attacks but eventually grew to include AI harnesses as well. Not very worried about them hacking me, more about accident prevention. So that means each VM must be running a completely independent kernel that's fully isolated from the host's file system. They must also have fail closed network filtering built in. > Anything you can point the rest of us to? I have published my virtdev's design document. https://github.com/matheusmoreira/virtdev/blob/master/DESIGN.md https://github.com/matheusmoreira/virtdev/blob/master/DESIGN... Yes, it is AI generated. In summary, it's a QEMU VM orchestrator with a base OS image and project specific delta images. VM lifecycle is managed by systemd. System level isolation is already pretty good and it already solves the "AI wiped out my $HOME" problem. I'm currently working on a custom network stack to replace the nftables based firewall.

KolibriFly 2mo ago

[dead]

matheusmoreira 2mo ago

I did the same thing. It was my first "vibecoded" project. I've been using it every day and it's great. I'm writing a custom Rust network stack for it right now. Gonna replace the current nftables firewall with it. As for Docker Sandboxes, I'll just ask Sol literally right now to see what it does better than my virtdev, and then I'll improve virtdev instead of using Docker.

rvz 2mo ago

Why developers will never pay for their tools.