3 ms·

Wow, I hope one day Linux will be able to support the exclusive MacOs/Windows technology of Docker Sandboxes. (it's in the doc, but kinda strange to not see so

by hokkos 2mo ago

Wow, I hope one day Linux will be able to support the exclusive MacOs/Windows technology of Docker Sandboxes. (it's in the doc, but kinda strange to not see some instructions on the main page, probably distro related)

crabmusket 2mo ago
There's always https://github.com/mensfeld/code-on-incus https://github.com/mensfeld/code-on-incus
stefanka 2mo ago
What about bubblewrap? It also provides a sandbox
- SwellJoe 2mo ago
  Yes, bubblewrap is superior to Docker for this. I wrote a tool to use bubblewrap for the purpose. It needs a tool to start it, or is at least much more convenient with a tool, because you need to take your session/auth data into the container, and if you want the agent to be able to start containers (agents love containers) within the container, you need some config magic mounted inside. You could manually do all that, or do it with a shell script, as well. But, this is how I did it, and you're likely to run into all the same little quirks I ran into: https://github.com/swelljoe/flar https://github.com/swelljoe/flar
  - stefanka 2mo ago
    Interesting. I’ve been trying to use bwrap, slirp4netns, and mitmproxy to create a simple Python script to get save shell for development. But it’s a huge time sink (and I might resort to podman)
ai_fry_ur_brain 2mo ago
[dead]
ethagnawl 2mo ago
Whoah. I took for granted it'd work on Linux.
- macNchz 2mo ago
  It does, for whatever reason the marketing page doesn’t advertise it but the docs have Linux instructions: https://docs.docker.com/ai/sandboxes/ https://docs.docker.com/ai/sandboxes/ I’ve been using this pretty extensively for a few months on Mac and Linux and have been super happy with it.
  - ethagnawl 2mo ago
    Thanks. That omission didn't smell right based on everything I know about Docker. Curious choice, indeed, not to show Linux install instructions.
    - brettpro 2mo ago
      When I tried this a month or so ago Linux support was markedly bad, and a quick look at the GitHub issues confirmed it wasn't just me and wasn't a priority for the company. I wouldn't advertise it either. The nails in the coffin were 1) login was required 2) login was broken because they "didn't consider" it would be run in a headless environment [0] and 3) they shipped with hardcoded binary paths and root requirements [1]. I moved on and use Incus directly with small helper scripts, smolvm, or a full fat VM running desktop Claude or ChatGPT if I (or someone I mentor) really needs the full app. I'm not yoloing every new claw agent in --dangerously-destroy-my-things mode, so network restrictions are best effort, though filesystem access stays tight. Either way, docker sandboxes really didn't seem to be it, and the company didn't seem interested in trying to be anything beyond an enterprise solution. 0. https://github.com/docker/sbx-releases/issues/186#issuecomment-4591544355 https://github.com/docker/sbx-releases/issues/186#issuecomme... 1. https://github.com/docker/sbx-releases/issues/48 https://github.com/docker/sbx-releases/issues/48
      - killix 2mo ago

by hokkos 2mo ago

crabmusket 2mo ago

There's always https://github.com/mensfeld/code-on-incus https://github.com/mensfeld/code-on-incus

stefanka 2mo ago

What about bubblewrap? It also provides a sandbox

SwellJoe 2mo ago
Yes, bubblewrap is superior to Docker for this. I wrote a tool to use bubblewrap for the purpose. It needs a tool to start it, or is at least much more convenient with a tool, because you need to take your session/auth data into the container, and if you want the agent to be able to start containers (agents love containers) within the container, you need some config magic mounted inside. You could manually do all that, or do it with a shell script, as well. But, this is how I did it, and you're likely to run into all the same little quirks I ran into: https://github.com/swelljoe/flar https://github.com/swelljoe/flar
- stefanka 2mo ago
  Interesting. I’ve been trying to use bwrap, slirp4netns, and mitmproxy to create a simple Python script to get save shell for development. But it’s a huge time sink (and I might resort to podman)

ai_fry_ur_brain 2mo ago

[dead]

ethagnawl 2mo ago

Whoah. I took for granted it'd work on Linux.

macNchz 2mo ago
It does, for whatever reason the marketing page doesn’t advertise it but the docs have Linux instructions: https://docs.docker.com/ai/sandboxes/ https://docs.docker.com/ai/sandboxes/ I’ve been using this pretty extensively for a few months on Mac and Linux and have been super happy with it.
- ethagnawl 2mo ago
  Thanks. That omission didn't smell right based on everything I know about Docker. Curious choice, indeed, not to show Linux install instructions.
  - brettpro 2mo ago
    When I tried this a month or so ago Linux support was markedly bad, and a quick look at the GitHub issues confirmed it wasn't just me and wasn't a priority for the company. I wouldn't advertise it either. The nails in the coffin were 1) login was required 2) login was broken because they "didn't consider" it would be run in a headless environment [0] and 3) they shipped with hardcoded binary paths and root requirements [1]. I moved on and use Incus directly with small helper scripts, smolvm, or a full fat VM running desktop Claude or ChatGPT if I (or someone I mentor) really needs the full app. I'm not yoloing every new claw agent in --dangerously-destroy-my-things mode, so network restrictions are best effort, though filesystem access stays tight. Either way, docker sandboxes really didn't seem to be it, and the company didn't seem interested in trying to be anything beyond an enterprise solution. 0. https://github.com/docker/sbx-releases/issues/186#issuecomment-4591544355 https://github.com/docker/sbx-releases/issues/186#issuecomme... 1. https://github.com/docker/sbx-releases/issues/48 https://github.com/docker/sbx-releases/issues/48
    - killix 2mo ago