Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Developing inside a virtual machine

blog.disintegrator.dev

Post reply on HN
Print view View original

51–60 of 147 posts

Re: Developing inside a virtual machine

#51

Post by Multicomp »

cachvico wrote: post #40
amelius wrote: post #4

Beats developing inside a docker container.

Does it though? I've developed in remote VMs before and the advantages are clear, but having a fully containerized development environment is really nice too because you can tear the whole thing down and rebuild at the drop of a hat. You can achieve that with a VM and scripts, but a Dockerfile is very lightweight and standard. Edit: Unless you literally mean "editing code in a container with vi". In which case yes I'…

I am currently doing development on a VM with remote SSH, but I use the terminal on said VM to run a docker container when I need to actually run and build the thing, so it is possible to get both remote SSH tooling and containerization benefits, without needing to build a docker container and SSH into it from vs code, which might be what GP was saying.

Re: Developing inside a virtual machine

#52

Post by skydhash »

jeswin wrote: post #43
apt-apt-apt-apt wrote: post #36

I accidentally typed 'npm install axioss' (extra s typo) this morning. When it successfully installed, it was terrifying to think that all source code, private files were instantly shared with malicious actors. Not only that, there was the prospect of having to somehow wipe and ensure all files were clean, reinstall the OS, and the possibility of some bootloader remnant still lurking. In this case, it seems that a se…

> VM seems like a good way to add some protection. Yeah, but someone should try to fix this anyway. It's not a nodejs-specific problem, but it's badly needed in node. Any of the 100s of authors whose packages I depend on might have made a typo, or just been careless. Software development requires a scary level of trust. I am also increasingly moving to VMs. I want tools (such as VSCode) to run on the main machine, bu…

The one trick I found that work well is to move everything in the VM. I usually opt for either emacs or vim, and if I need an IDE, I install i3. It just takes a moment to copy my dotfiles over.

Re: Developing inside a virtual machine

#53

Post by bitwize »

UltraSane wrote: post #41
deergomoo wrote: post #15

Earlier quoted context omitted.

Heh, my employer is rolling out Zscaler this year. The limited trial a few months ago was hell for folks using WSL primarily, with Docker images adding an additional layer of pain. The people in the trial got very little done until it was decided to pause it, and I do not have high hopes for when it’s tried again. It strikes me as basically running malware in the name of security.

I worked at a government agency that used Zscaler to perform TLS MITM inspection. You have to create a tunnel to a Zcaler datacenter and send all your traffic to them encrypted with a certificate they provide so they can decrypt it. Then they encrypt it again and send it on its way. It can detect things that otherwise could not but you are putting a LOT of trust into Zscaler security because anyone who hacks them can…

You'd think last year's Clownstrike incident would put the lie to the efficacy of the fucking-for-virginity approach to endpoint security favored by organizations but no.

At the enterprise level, security isn't really about security, it's about having an audit trail so bad actors can be caught after the fact.

Re: Developing inside a virtual machine

#54

Post by fpoling »

jeswin wrote: post #43
apt-apt-apt-apt wrote: post #36

I accidentally typed 'npm install axioss' (extra s typo) this morning. When it successfully installed, it was terrifying to think that all source code, private files were instantly shared with malicious actors. Not only that, there was the prospect of having to somehow wipe and ensure all files were clean, reinstall the OS, and the possibility of some bootloader remnant still lurking. In this case, it seems that a se…

> VM seems like a good way to add some protection. Yeah, but someone should try to fix this anyway. It's not a nodejs-specific problem, but it's badly needed in node. Any of the 100s of authors whose packages I depend on might have made a typo, or just been careless. Software development requires a scary level of trust. I am also increasingly moving to VMs. I want tools (such as VSCode) to run on the main machine, bu…

VSCode assumes that the remote side is trusted. So if VM is compromised, VSCode on the host can be compromised as well.

For this reason I run VSCode inside the VM.

Re: Developing inside a virtual machine

#55

Post by makeitdouble »

tonymet wrote: post #49
makeitdouble wrote: post #31

Earlier quoted context omitted.

In general, yes. One weird quirk: networking can be peculiar. Windows creates a magic bridging between the host and WSL, and as anything magic, it can break for specific use cases. VPN is one [0]: my WSL instances lose outgoing networking when connecting to our company VPN. There are workarounds but none are trivial. [0] https://superuser.com/questions/1715764/wsl2-has-no-connecti...

Good to know. My vpn works but I believe it’s wireguard-based. I wonder if yours is TUN/TAP or another driver

It seems to be TAP (layer 2 tunneling)

Thinking about it, as the whole machine is under MDM (I only have the VPN on my dedicated work machine), there might be additional quirks that mess with the networking as well. Even bridging the Wi-fi to it was kind of a PITA.

Re: Developing inside a virtual machine

#56

Post by fulafel »

nneonneo wrote: post #19

You can use pbcopy/pbpaste in a Linux VM on Mac by making a shell script wrapper in the VM that calls “ssh mac-host pb{copy|paste}” - that is, basically ssh back from the guest to the host to use its clipboard. It’s seamless and fast since it’s basically a local network connection. My specific setup is that I use an authorized_keys entry on the host that restricts the guest to running a specific command, which limits…

Having that kind of ssh access from guest to host negates the security barrier benefits that using a dev VM might have.

Re: Developing inside a virtual machine

#57

Post by zokier »

I use similar setup on Windows (with vmware/virtualbox/hyper-v at different times), which kinda highlights one additional upside: it doesn't matter that much what the host system is, you can do your work all the same regardless if it is macos/windows (or even linux). As long as it can run the vm and vscode, you are good to go. Although admittedly Apple going with aarch64 throws a small wrench in the equation.

It is especially nice in corporate environment, where the host system is generally managed by IT and the devices are largely impersonal (standardized configuration, standardized software). You can carve out a corner to make your own and work there.

Re: Developing inside a virtual machine

#58

Post by TowerTall »

I run my entire work computer inside of a VM. I work from home and have a powerfull desktop i use for my private stuff hooked up to my 3 monitors. My work pc is a vmware vm running inside of vmware pro. I can minimize the work vm and work it out my sight or I can selective choose that the vm should use 1, 2 or 3 monitors and it is easy to switch back and forth between work and private without have any work related data on my private desktop. The work vm is domain joined, o365 enterprise joined and loocked down in ridicilous ways by cooperate IT but now i can run that from my private powerfull PC without worring that corp IT messes up my private computer.

Re: Developing inside a virtual machine

#59

Post by nneonneo »

fulafel wrote: post #56
nneonneo wrote: post #19

You can use pbcopy/pbpaste in a Linux VM on Mac by making a shell script wrapper in the VM that calls “ssh mac-host pb{copy|paste}” - that is, basically ssh back from the guest to the host to use its clipboard. It’s seamless and fast since it’s basically a local network connection. My specific setup is that I use an authorized_keys entry on the host that restricts the guest to running a specific command, which limits…

Having that kind of ssh access from guest to host negates the security barrier benefits that using a dev VM might have.

Please read the second part - I use a command restriction in authorized_keys so that the guest can only call certain commands.

Yes, the guest has “unlimited” access to the pasteboard, which does introduce some risks. For example, the guest could set a malicious command line that you paste into the terminal - which is generally mitigated with paste bracketing in zsh, vim, etc. It definitely weakens the isolation to a certain extent, but I don’t think it completely negates the security barrier as you claim.

Re: Developing inside a virtual machine

#60

Post by nneonneo »

hamandcheese wrote: post #44
nneonneo wrote: post #19

You can use pbcopy/pbpaste in a Linux VM on Mac by making a shell script wrapper in the VM that calls “ssh mac-host pb{copy|paste}” - that is, basically ssh back from the guest to the host to use its clipboard. It’s seamless and fast since it’s basically a local network connection. My specific setup is that I use an authorized_keys entry on the host that restricts the guest to running a specific command, which limits…

In the past, I set up something similar, except I would reverse forward my local ssh port to my remote servers (so that I could easily ssh back regardless of network topology). Ultimately I didn't keep it out of security concerns -- I had done nothing to limit the commands. On the topic of limiting the possible commands - for my use case I only needed pbcopy. Maybe think twice before letting an insecure VM or remote…

Yep - good point. Another option would be to set a confirmation in front of every paste attempt - for example, putting Touch ID in front of any pbpaste call from the guest (which you can enforce with the authorized_keys command). That should be low-friction enough that it isn’t a major delay to your development process, while still being reasonably secure and providing the convenience of pasteboard access.
Post reply on HN