191–200 of 434 posts
I planed to do exactly this, with podman instead of docker, volume support. Like: $ podman run -it --rm -v .:/workspace local-dev-ia /usr/bin/oc Configured with a .env file. Hope to do it hopefully before the end of the week.
This is nowhere near "exactly this". Docker Sandboxes uses micro VMs, you just use regular containers which have completely different security properties.
What is the main benefit over doing something like: docker run --runtime krun --rm -it -v $(pwd):/workspace/$(basename $(pwd)) -w /workspace/$(basename $(pwd)) --network restricted-net ghcr.io/openai/codex-universal:latest sh That runs the codex OCI in a qemu microvm. From what I can see, more fine grained network and filesystem access control as well as convenience?
> That runs the codex OCI in a qemu microvm.
AFAIU it's actually the other way around: krun spawns a libkrun-based (not QEMU-based) VM inside a crun container. Source: https://github.com/libkrun/libkrun/discussions/538#discussio...
So with your solution you get the additional security benefit of containerizing the hypervisor on the host.
The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders. I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in. Closest open source I have seen is https://earendil-works.github.io/gondol…
What I run is one hardened QEMU/KVM VM per project holding the whole dev environment (editors, agents, containers), with nftables on the host allowing internet egress but dropping anything aimed at the host, the LAN, or any other private address, plus an allowlist for deliberate exceptions. Basically, it's a plain QEMU/KVM VM on a stock Debian cloud image: device model stripped down to a virtio disk, a virtio NIC and…
To everyone sharing their favorite container-based sandboxing solution: Docker Sandbox does not use containers for isolation. It spawns the workload in a libkrun-based micro VM, which has vastly different security properties.
eg: https://josecastillolema.github.io/podman-wasm-libkrun/#libk...
Has anyone tried https://bhatti.sh/ ?
I planed to do exactly this, with podman instead of docker, volume support. Like: $ podman run -it --rm -v .:/workspace local-dev-ia /usr/bin/oc Configured with a .env file. Hope to do it hopefully before the end of the week.
> exactly this This is nowhere near "exactly this". Docker Sandboxes uses micro VMs, you just use regular containers which have completely different security properties.
The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders. I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in. Closest open source I have seen is https://earendil-works.github.io/gondol…
Don't want to say it's better, but I implemented Agent Circus ( https://github.com/Embedded-Focus/agent-circus ) which allows to lock AI agent harnesses into docker containers. I'm using it as my main driver since months. Support for running agent harnesses in unprivileged podman containers is on my feature list. :-)
Only real alternative is to use microvms. My goto solution for this are apple/containers.
Earlier quoted context omitted.
Container escapes are more common than you think. Common enough for AWS not to rely on containers for their serverless functions, common enough for Google to say: "Untrusted code shouldn't rely on the container security boundary [..]" [1] The same is not applicable for any kind of sandboxing for two reasons: 1. The boundary is in the kernal’s own code, enforced by the thing you are trying to be protected from. -> Use…
What if you use tools like bubblewrap or nono inside the container? Say I want to use pi inside a container. If I wrap pi within a bubblewrap or within nono, how is that less secure than using a vm? Also, I think most people run containers inside VMs anyway and not directly on their hosts (on Mac and windows you have to use a vm anyway).