4 ms·

This is why I run opencode and similar things in a dedicated KVM virtual machine that lives on a system under my desk that doesn't have access to my user accoun

This is why I run opencode and similar things in a dedicated KVM virtual machine that lives on a system under my desk that doesn't have access to my user account data, documents folder, photos/video, ~/.ssh/, other API keys, ~/.anything-else/, you name it. I think it's absolutely wild that there are people out there running cutting-edge LLMs and agent harnesses and tools on the same hardware and same user/disk/session environment that contains like, PDFs of their paystubs, their 401k records, their tax returns for previous years, contracts/real estate details, whatever other personal things you keep in your Documents folder as an educated modern professional with obligations and debts and assets. Sometimes this VM gets duplicated for specific projects and then various dependencies for testing installed in it that are specific to what the needs are. As an additional advantage it means I can leave it running in the background doing things when I want to shut my laptop, then resume talking to it later. (edit, for everyone who hasn't seen it yet, take a look at the "grok uploads your entire code base" category of problem: https://www.google.com/search?client=firefox-b-d&q=grok+uploads+git+code+base https://www.google.com/search?client=firefox-b-d&q=grok+uplo... )

jbstack 2mo ago
I do something similar. I have a base NixOS image in Incus, with whatever tools apply to every project (e.g. Git, OpenCode) already installed. When I work on a project, I spin up a VM instance, use nix shell to add any project-specific tools, then share only the project folder from the host to the guest. This way, the worst the agent can do is destroy my project folder, and I can always restore that from another clone of the repo. I know a lot of people are using containers for sandboxing, but given how capable the latest models have shown themselves to be for breaking out of sandboxes, I prefer the extra isolation of VMs for this. I do all this locally - it's an interesting point to able to turn the laptop off but keep the agents running. I might consider running some of these on my homelab server just for that.
- walrus01 2mo ago
  My setup is basically, the 'runs harnesses' VM is accessible by ssh (of course) but it also has an xfce4/xorg desktop environment running on it. I can easily form an ssh tunnel to it and then use tigervnc on my workstation laptop. The VNC session is sized to be exactly pixel 1:1 match of my laptop screen size, so I run it as fullscreen and use the macos hot-corner functionality or multi-desktop session switch hotkeys to toggle between it and my 'real' laptop/bare metal workstation. Having a GUI on the thing lets me leave all kinds of things running persistently in the background that might be bothersome if interrupted running on my laptop. It also has much higher average speed/reliability 24x7 internet access via my home broadband connection than wherever I might happen to be with my laptop. The main hassle that I've found is that I have to mentally train myself to remember that a lot of the keyboard shortcuts in a boring stock xfce4 desktop environment (and other applications I can run with gnome and kde libraries installed) are quite different than MacOS, when toggling back and forth between the two.
  - NitpickLawyer 2mo ago
    > Having a GUI on the thing lets me leave all kinds of things running persistently in the background that might be bothersome if interrupted running on my laptop. Unless you actually need GUIs, you could just use screen/tmux or the newer versions like zellij/etc.
    - walrus01 2mo ago
      I use screen extensively, the GUI is for leaving things like QGIS running full screen (which is sure not going to work in a TUI). Both CLI environment and GUI get used.
phoghed 2mo ago
My work computer has nothing of personal value to me. It has everything I need to do work. The agent does my work. Why wouldn’t I just run this shit? We’ve all been executing arbitrary code from a gorillion packages from pypi, npm, cargo, etc for well over a decade. Getting anyone to care much will be an uphill battle.
- walrus01 2mo ago
  If you work for $bigcorp and have a work computer with nothing of personal value to you, all the more power to you. Great way to keep things separated. I'm writing more from the perspective of somebody whose home office and workstation environments contain both tons of personal data and tons of consulting/freelance/project/tasks-for-clients stuff.
  - phoghed 2mo ago
    I wouldn’t mix those two things anyway. What if they sue you and in discovery your 42 gigs of furry porn comes out?
    - walrus01 2mo ago
      42GB of furry porn, no, but they're welcome to the billable man hours involved in sifting through 30TB of public GIS datasets and similar.
dolmen 2mo ago
The article goes beyond and warn about jailing MCP servers independently of the agent itself (which also deserves to be jailed).

jbstack 2mo ago

I do something similar. I have a base NixOS image in Incus, with whatever tools apply to every project (e.g. Git, OpenCode) already installed. When I work on a project, I spin up a VM instance, use nix shell to add any project-specific tools, then share only the project folder from the host to the guest. This way, the worst the agent can do is destroy my project folder, and I can always restore that from another clone of the repo. I know a lot of people are using containers for sandboxing, but given how capable the latest models have shown themselves to be for breaking out of sandboxes, I prefer the extra isolation of VMs for this. I do all this locally - it's an interesting point to able to turn the laptop off but keep the agents running. I might consider running some of these on my homelab server just for that.

walrus01 2mo ago
My setup is basically, the 'runs harnesses' VM is accessible by ssh (of course) but it also has an xfce4/xorg desktop environment running on it. I can easily form an ssh tunnel to it and then use tigervnc on my workstation laptop. The VNC session is sized to be exactly pixel 1:1 match of my laptop screen size, so I run it as fullscreen and use the macos hot-corner functionality or multi-desktop session switch hotkeys to toggle between it and my 'real' laptop/bare metal workstation. Having a GUI on the thing lets me leave all kinds of things running persistently in the background that might be bothersome if interrupted running on my laptop. It also has much higher average speed/reliability 24x7 internet access via my home broadband connection than wherever I might happen to be with my laptop. The main hassle that I've found is that I have to mentally train myself to remember that a lot of the keyboard shortcuts in a boring stock xfce4 desktop environment (and other applications I can run with gnome and kde libraries installed) are quite different than MacOS, when toggling back and forth between the two.
- NitpickLawyer 2mo ago
  > Having a GUI on the thing lets me leave all kinds of things running persistently in the background that might be bothersome if interrupted running on my laptop. Unless you actually need GUIs, you could just use screen/tmux or the newer versions like zellij/etc.
  - walrus01 2mo ago
    I use screen extensively, the GUI is for leaving things like QGIS running full screen (which is sure not going to work in a TUI). Both CLI environment and GUI get used.

phoghed 2mo ago

My work computer has nothing of personal value to me. It has everything I need to do work. The agent does my work. Why wouldn’t I just run this shit? We’ve all been executing arbitrary code from a gorillion packages from pypi, npm, cargo, etc for well over a decade. Getting anyone to care much will be an uphill battle.

walrus01 2mo ago
If you work for $bigcorp and have a work computer with nothing of personal value to you, all the more power to you. Great way to keep things separated. I'm writing more from the perspective of somebody whose home office and workstation environments contain both tons of personal data and tons of consulting/freelance/project/tasks-for-clients stuff.
- phoghed 2mo ago
  I wouldn’t mix those two things anyway. What if they sue you and in discovery your 42 gigs of furry porn comes out?
  - walrus01 2mo ago
    42GB of furry porn, no, but they're welcome to the billable man hours involved in sifting through 30TB of public GIS datasets and similar.

dolmen 2mo ago

The article goes beyond and warn about jailing MCP servers independently of the agent itself (which also deserves to be jailed).