4 ms·

Coop – Isolated VM Environments for Running Claude Code and Codex

71 points by aggrrrh 27d ago

nirmeet011011 27d ago
[flagged]
darkamaul 27d ago
I use coop daily and found it super convenient for my use case (ie letting agents go on with no access to my other projects or personal files) I would recommend anyone that has desire to provide stricter boundaries to agents to give it a try - while remembering that a motivated agent would probably be able to escape it :)
DarmokTanagra 27d ago
[dead]
3stacks 27d ago
Oh awesome, I just started building something like this but nice to use something off the shelf for once. I used a project called toolgate to autoapprove "safe" tool calls but request permission on riskier calls declaratively. But there's so many unnecessary tool permission requests
- nibbleyou 26d ago
  Would you mind sharing a link to toolgate. Google search found a lot of matches but none that matched your description.
  - 3stacks 18d ago
    Sorry, I missed your reply. It's a very small project by a friend of mine so I'm not surprised it doesn't get a lot of love: http://github.com/brycehans/toolgate http://github.com/brycehans/toolgate I really appreciate the flexibility of the rules. For example I have it auto-approve `aws` cli operations when using a read-only --profile flag, but have it always ask for a privileged profile
vladde 27d ago
sidenote: coop is also a large swedish grocery chain, pronounced the same way :) https://www.coop.se/ https://www.coop.se/
- wolfi1 27d ago
  not only in Sweden, in Germany and Switzerland as well. I guess it has the same origins in the trade unionist purchasing cooperatives at the turn of the century from the 19th to the 20th
  - mkesper 27d ago
    At least in Germany, it's pronounced co-op, though. The stores got rebranded meanwhile. https://www.coop.de/coop/historie/ https://www.coop.de/coop/historie/
  - toyg 27d ago
    Italy, UK... Yep.
- sceptic123 27d ago
  we call our local co-op "the coop" for no real reason :)
compiotr 27d ago
How is this different from docker sbx or microsandbox.dev? Not saying we don't need more alternatives, just asking to see if there is a reason to switch.
- darkamaul 27d ago
  I _think_ (disclaimer: I have only read the documention of the two tools) they overlap quite a bit. The main idea is to get VM isolation for your agents env.
- mkesper 27d ago
  Docker sandbox is proprietary. https://github.com/docker/sbx-releases?tab=License-1-ov-file#License-1-ov-file https://github.com/docker/sbx-releases?tab=License-1-ov-file...
SegmentTree 27d ago
Personally I am using Eclipse Enclave to sandbox my agents. Good to see another fully open source solution in Coop.
- vivzkestrel 26d ago
  isnt eclipse enclave using docker internally? https://github.com/search?q=repo%3Aeclipse-enclave%2Fenclave%20docker&type=code https://github.com/search?q=repo%3Aeclipse-enclave%2Fenclave...
  - SegmentTree 26d ago
    Yes, that's how I am using it. However there is an experimental qemu microvm backend and a push for podman support if that is more interesting for you.
sid_ships 27d ago
[dead]
messh 27d ago
How is this better than say using bubblewrap sandbox solutions. Is it safer, is that the advantage?
securecloudgrou 26d ago
[flagged]
hirak10 26d ago
[dead]
bargava 26d ago
I use cco [1]. There's also drydock [2] - but this is macOS only. -- [1] https://github.com/nikvdp/cco https://github.com/nikvdp/cco [2] https://github.com/sricola/drydock https://github.com/sricola/drydock
thiagoc77 26d ago
[dead]

71 points by aggrrrh 27d ago

[flagged]

I use coop daily and found it super convenient for my use case (ie letting agents go on with no access to my other projects or personal files) I would recommend anyone that has desire to provide stricter boundaries to agents to give it a try - while remembering that a motivated agent would probably be able to escape it :)

DarmokTanagra 27d ago

[dead]

3stacks 27d ago

Oh awesome, I just started building something like this but nice to use something off the shelf for once. I used a project called toolgate to autoapprove "safe" tool calls but request permission on riskier calls declaratively. But there's so many unnecessary tool permission requests

nibbleyou 26d ago
Would you mind sharing a link to toolgate. Google search found a lot of matches but none that matched your description.
- 3stacks 18d ago
  Sorry, I missed your reply. It's a very small project by a friend of mine so I'm not surprised it doesn't get a lot of love: http://github.com/brycehans/toolgate http://github.com/brycehans/toolgate I really appreciate the flexibility of the rules. For example I have it auto-approve `aws` cli operations when using a read-only --profile flag, but have it always ask for a privileged profile

vladde 27d ago

sidenote: coop is also a large swedish grocery chain, pronounced the same way :) https://www.coop.se/ https://www.coop.se/

wolfi1 27d ago
not only in Sweden, in Germany and Switzerland as well. I guess it has the same origins in the trade unionist purchasing cooperatives at the turn of the century from the 19th to the 20th
- mkesper 27d ago
  At least in Germany, it's pronounced co-op, though. The stores got rebranded meanwhile. https://www.coop.de/coop/historie/ https://www.coop.de/coop/historie/
- toyg 27d ago
  Italy, UK... Yep.
sceptic123 27d ago
we call our local co-op "the coop" for no real reason :)

compiotr 27d ago

How is this different from docker sbx or microsandbox.dev? Not saying we don't need more alternatives, just asking to see if there is a reason to switch.

darkamaul 27d ago
I _think_ (disclaimer: I have only read the documention of the two tools) they overlap quite a bit. The main idea is to get VM isolation for your agents env.
mkesper 27d ago
Docker sandbox is proprietary. https://github.com/docker/sbx-releases?tab=License-1-ov-file#License-1-ov-file https://github.com/docker/sbx-releases?tab=License-1-ov-file...

SegmentTree 27d ago

Personally I am using Eclipse Enclave to sandbox my agents. Good to see another fully open source solution in Coop.

vivzkestrel 26d ago
isnt eclipse enclave using docker internally? https://github.com/search?q=repo%3Aeclipse-enclave%2Fenclave%20docker&type=code https://github.com/search?q=repo%3Aeclipse-enclave%2Fenclave...
- SegmentTree 26d ago
  Yes, that's how I am using it. However there is an experimental qemu microvm backend and a push for podman support if that is more interesting for you.

sid_ships 27d ago

[dead]

messh 27d ago

How is this better than say using bubblewrap sandbox solutions. Is it safer, is that the advantage?

securecloudgrou 26d ago

[flagged]

hirak10 26d ago

[dead]

bargava 26d ago

I use cco [1]. There's also drydock [2] - but this is macOS only. -- [1] https://github.com/nikvdp/cco https://github.com/nikvdp/cco [2] https://github.com/sricola/drydock https://github.com/sricola/drydock

thiagoc77 26d ago

[dead]