Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Switching to Claude Code and VSCode Inside Docker

timsh.org

Post reply on HN
Print view View original

71–80 of 170 posts

Re: Switching to Claude Code and VSCode Inside Docker

#71

Post by dannymi »

tartakovsky wrote: post #2

2-ish questions: Is this level of fear typical or reasonable? If so, why doesn’t Anthropic / AI code gen providers offer this type of service? Hard to believe Anthropic is not secure in some sense — like what if Claude Code is already inside some container-like thing? Is it actually true that Claude cannot bust out of the container?

>Is this level of fear typical or reasonable?

Of course. Also with regular customer projects. Even without AI--but of course having an idiot be able to execute commands on your PC makes the risk higher.

> If so, why doesn’t Anthropic / AI code gen providers offer this type of service?

Why? Separate the concerns. Isolation is a concern depending on my own risk appetite. I do not want stuff to decide on my behalf what's inside the container and what's outside. That said, they do have devcontainer support (like the article says).

>Hard to believe Anthropic is not secure in some sense — like what if Claude Code is already inside some container-like thing?

It's a node program. It does ask you about every command it's gonna execute before it does it, though.

>Is it actually true that Claude cannot bust out of the container?

There are (sporadic) container escape exploits--but it's much harder than not having a container.

You can also use a qemu vm. Good luck escaping that.

Or an extra user account--I'm thinking of doing that next.

Re: Switching to Claude Code and VSCode Inside Docker

#72

Post by jon-wood »

churchsor_ai wrote: post #52
CGamesPlay wrote: post #6

If you are a VSCode hater (like me), you can achieve the same thing using the open-source, Microsoft-built, official devcontainer CLI [0], which is exactly what VSCode uses under the hood. You don't get automatic port forwarding with this tool, which includes SSH Agent forwarding, so you'll likely want to pair this with installing SSH into your devcontainers, or using some other tool that does the job. I built a tool…

I like the CLI for commands, but would rather work with an agent chat interface for vibing, which unfortunately I’m becoming increasingly reliant on, even though it’s gotten me into trouble with larger projects. I have many environments locally, some dependent on others, and some require local databases. I use containers in production, but not always locally. It’s almost a hellscape situation for trying to setup a fu…

> which unfortunately I’m becoming increasingly reliant on, even though it’s gotten me into trouble with larger projects

You could… not do this. You know it causes you problems, you consider it unfortunate that you’re becoming more reliant on it, and yet for some reason you’re choosing to continue anyway. Why are you doing that?

Re: Switching to Claude Code and VSCode Inside Docker

#74

Post by skydhash »

unsupp0rted wrote: post #69
CGamesPlay wrote: post #6

If you are a VSCode hater (like me), you can achieve the same thing using the open-source, Microsoft-built, official devcontainer CLI [0], which is exactly what VSCode uses under the hood. You don't get automatic port forwarding with this tool, which includes SSH Agent forwarding, so you'll likely want to pair this with installing SSH into your devcontainers, or using some other tool that does the job. I built a tool…

> If you are a VSCode hater (like me) What are some reasons to hate VSCode?

It’s clumsy as hell. It’s neither a good editor, which focus on being fast when doing things with text, nor a good IDE, which is more about the tooling and getting a project done. It’s trying to be both at the same time. And the result is bad at both.

Re: Switching to Claude Code and VSCode Inside Docker

#75

Post by 4gotunameagain »

unsupp0rted wrote: post #69
CGamesPlay wrote: post #6

If you are a VSCode hater (like me), you can achieve the same thing using the open-source, Microsoft-built, official devcontainer CLI [0], which is exactly what VSCode uses under the hood. You don't get automatic port forwarding with this tool, which includes SSH Agent forwarding, so you'll likely want to pair this with installing SSH into your devcontainers, or using some other tool that does the job. I built a tool…

> If you are a VSCode hater (like me) What are some reasons to hate VSCode?

Microsoft ?

Through the use of amazing PR they have made people forget about their Embrace, extend, and extinguish strategy with open source.

Re: Switching to Claude Code and VSCode Inside Docker

#76

Post by nikolayasdf123 »

ed_mercer wrote: post #73

I don't get these posts. I'm using claude --dangerously-skip-permissions all day and haven't had a single issue. In my experience it doesn't just randomly start erasing your hard drives. Also having a proper CLAUDE.md probably helps.

> it doesn't just randomly start erasing your hard drives.

if it did, it would be too late, wouldn't it?

Re: Switching to Claude Code and VSCode Inside Docker

#77

Post by Revisional_Sin »

tartakovsky wrote: post #2

2-ish questions: Is this level of fear typical or reasonable? If so, why doesn’t Anthropic / AI code gen providers offer this type of service? Hard to believe Anthropic is not secure in some sense — like what if Claude Code is already inside some container-like thing? Is it actually true that Claude cannot bust out of the container?

You either have the option of approving each command manually, or you can let it run commands autonomously. If you let it run any commands then you have the risk of it doing something stupid (mainly deleting files).

You also have MCP tools running on your machine, which might have security issues.

Re: Switching to Claude Code and VSCode Inside Docker

#78

Post by CGamesPlay »

unsupp0rted wrote: post #69
CGamesPlay wrote: post #6

If you are a VSCode hater (like me), you can achieve the same thing using the open-source, Microsoft-built, official devcontainer CLI [0], which is exactly what VSCode uses under the hood. You don't get automatic port forwarding with this tool, which includes SSH Agent forwarding, so you'll likely want to pair this with installing SSH into your devcontainers, or using some other tool that does the job. I built a tool…

> If you are a VSCode hater (like me) What are some reasons to hate VSCode?

Ultimately, they're about as trite as reasons to hate Vim or Emacs. It boils down to preference, and I'm outlining a path to using another editor and getting access to some of the same features.

Re: Switching to Claude Code and VSCode Inside Docker

#79

Post by skydhash »

jMyles wrote: post #4

I put in a full day trying to get Claude Code and VSCode to work inside Docker. I wasn't able to get the window to properly display in my wayland session.

You need to share the wayland socket (how programs talk to the compositor) with the container in docker. I’ve seen a script that does that on GitHub but I can’t remember the name. Distrobox and Toolbx also does this, but they also share your home directory with the container because that’s where all your config are.

Re: Switching to Claude Code and VSCode Inside Docker

#80

Post by CGamesPlay »

macrolime wrote: post #55
CGamesPlay wrote: post #6

If you are a VSCode hater (like me), you can achieve the same thing using the open-source, Microsoft-built, official devcontainer CLI [0], which is exactly what VSCode uses under the hood. You don't get automatic port forwarding with this tool, which includes SSH Agent forwarding, so you'll likely want to pair this with installing SSH into your devcontainers, or using some other tool that does the job. I built a tool…

I ssh into my server, then use the devcontainer cli tool to open a shell in the dev container. Found that easier than installing ssh in every container, especially when there's lots of them. I made a simple command line tool for helping the process, so I don't have to type out any long commands. If I run it it will list the running dev containers and I give them each a number to I don't have to use the full ID.

Yeah, this works. Two drawbacks: you have to rebuild the container when the port forwarding configuration changes, and the port forwards have to be unique on the entire machine.
Post reply on HN