Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using proxies to hide secrets from Claude Code

joinformal.com

Post reply on HN
Print view View original

1–10 of 61 posts

Re: Using proxies to hide secrets from Claude Code

#5

Post by TheRoque »

At the moment I'm just using "sops" [1]. I have my env var files encrypted uth AGE encryption. Then I run whatever I want to run with "sops exec-env ...", it's basically forwarding the secrets to your program.

I like it because it's pretty easy to use, however it's not fool-proof: if the editor which you use for editing the env vars is crashing or killed suddently, it will leave a "temp" file with the decrypted vars on your computer. Also, if this same editor has AI features in it, it may read the decrypted vars anyways.

- [1]: https://github.com/getsops/sops

Re: Using proxies to hide secrets from Claude Code

#6

Post by samlinnfer »

Here's the set up I use on Linux:

The idea is to completely sandbox the program, and allow only access to specific bind mounted folders. But we also want to have to the frills of using GUI programs, audio, and network access. runc (https://github.com/opencontainers/runc) allows us to do exactly this.

My config sets up a container with folders bind mounted from the host. The only difficult part is setting up a transparent network proxy so that all the programs that need internet just work.

Container has a process namespace, network namespace, etc and has no access to host except through the bind mounted folders. Network is provided via a domain socket inside a bind mounted folder. GUI programs work by passing through a Wayland socket in a folder and setting environmental variables.

The set up looks like this

    * config.json - runc config
    * run.sh - runs runc and the proxy server
    * rootfs/ - runc rootfs (created by exporting a docker container) `mkdir rootfs && docker export $(docker create archlinux:multilib-devel) | tar -C rootfs -xvf -`
    * net/ - folder that is bind mounted into the container for networking
Inside the container (inside rootfs/root):

    * net-conf.sh - transparent proxy setup
    * nft.conf - transparent proxy nft config
    * start.sh - run as a user account
Clone-able repo with the files: https://github.com/dogestreet/dev-container

Re: Using proxies to hide secrets from Claude Code

#7

Post by jclarkcom »

TheRoque wrote: post #5

At the moment I'm just using "sops" [1]. I have my env var files encrypted uth AGE encryption. Then I run whatever I want to run with "sops exec-env ...", it's basically forwarding the secrets to your program. I like it because it's pretty easy to use, however it's not fool-proof: if the editor which you use for editing the env vars is crashing or killed suddently, it will leave a "temp" file with the decrypted vars…

I do something similar but this only protects secrets at rest. If you app has an exploit an attack could just export all your secrets to a file.

I prototyped a solution where I use an external debugger to monitor my app, when the app needs a secret it generates a breakpoint and the debugger catches it and then inspects the call stack of the function requesting the secret and then copies it into the process memory (intended to be erased immediately after use). Not 100% security but a big improvement and a bit more flexible and auditable compared to a proxy

Re: Using proxies to hide secrets from Claude Code

#9

Post by brunoborges »

samlinnfer wrote: post #6

Here's the set up I use on Linux: The idea is to completely sandbox the program, and allow only access to specific bind mounted folders. But we also want to have to the frills of using GUI programs, audio, and network access. runc ( https://github.com/opencontainers/runc ) allows us to do exactly this. My config sets up a container with folders bind mounted from the host. The only difficult part is setting up a trans…

Any particular reason why you shared these files in a gist rather a repo?

Re: Using proxies to hide secrets from Claude Code

#10

Post by idorosen »

samlinnfer wrote: post #6

Here's the set up I use on Linux: The idea is to completely sandbox the program, and allow only access to specific bind mounted folders. But we also want to have to the frills of using GUI programs, audio, and network access. runc ( https://github.com/opencontainers/runc ) allows us to do exactly this. My config sets up a container with folders bind mounted from the host. The only difficult part is setting up a trans…

try firejail insread
Post reply on HN