Go hard on agents, not on your filesystem • Hacker News Board

Re: Go hard on agents, not on your filesystem

#31

Post by throwaway6734 » Sat, Mar 28, 2026, 2:13 AM UTC

AnotherGoodName wrote: post #29

cozzyd wrote: post #28

Earlier quoted context omitted.

Is this a real sandbox or just a pretty please?

https://code.claude.com/docs/en/sandboxing says they integrated bubblewrap (linux/windows), seatbelt (macos) and give an error if sandbox can't be supported so appears to be real.

https://docs.docker.com/ai/sandboxes/ Any idea on how that compares to this docker feature in development?

Re: Go hard on agents, not on your filesystem

#32

Post by justinde » Sat, Mar 28, 2026, 2:14 AM UTC

.claude/settings.json: { "sandbox": { "enabled": true, "filesystem": { "allowRead": ["."], "denyRead": ["~/"], "allowWrite": ["."] } } }

Use it! :) https://code.claude.com/docs/en/sandboxing

Re: Go hard on agents, not on your filesystem

#33

Post by cindyllm » Sat, Mar 28, 2026, 2:18 AM UTC

mememememememo wrote: post #6

mazieres wrote: post #2

What would it take for people to stop recklessly running unconstrained AI agents on machines they actually care about? A Stanford researcher thinks the answer is a new lightweight Linux container system that you don't have to configure or think about.

Yes. It is like walking arounf your house with a flamethrower, but you added fire retardant. Just take the flamethower to a shed you don't mind losing. Which is some kind of cloud workspace most likely. Maybe an old laptop. Still if you yolo online access and give it cred or access to tools that are authenticated there can still be dragons.

[dead]

Re: Go hard on agents, not on your filesystem

#34

Post by charcircuit » Sat, Mar 28, 2026, 2:23 AM UTC

I want agents to modify the file system. I want them to be able to manage my computer if it thinks it's a good idea. If a build fails due to running out of disk space I want it to be able to find appropriate stuff to delete to free up space.

Re: Go hard on agents, not on your filesystem

#35

Post by gonzalohm » Sat, Mar 28, 2026, 2:23 AM UTC

Not sure I understand the problem. Are people just letting AI do anything? I use Claude Code and it asks for permission to run commands, edit files, etc. No need for sandbox

Re: Go hard on agents, not on your filesystem

#36

Post by vardalab » Sat, Mar 28, 2026, 2:25 AM UTC

mazieres wrote: post #2

What would it take for people to stop recklessly running unconstrained AI agents on machines they actually care about? A Stanford researcher thinks the answer is a new lightweight Linux container system that you don't have to configure or think about.

unconstrained AI agents are what makes it so useful though. I have been using claude for almost a year now and the biggest unlock was to stop being a worrywart early on and just literally giving it ssh keys and telling it to fix something. ofc I have backups and do run it in VM but in that VM it helps me manage by infra and i have a decent size homelab that would be no fun but a chore without this assistant.

Re: Go hard on agents, not on your filesystem

#37

Post by kristofferR » Sat, Mar 28, 2026, 2:33 AM UTC

Also recommended:

https://github.com/kenryu42/claude-code-safety-net

Re: Go hard on agents, not on your filesystem

#38

Post by ray_v » Sat, Mar 28, 2026, 2:47 AM UTC

cozzyd wrote: post #28

AnotherGoodName wrote: post #15

Add this to .claude/settings.json: { "sandbox": { "enabled": true, "filesystem": { "allowRead": ["."], "denyRead": ["~/"], "allowWrite": ["."], "denyWrite": ["/"] } } } You can change the read part if you're ok with it reading outside. This feature was only added 10 days ago fwiw but it's great and pretty much this.

Is this a real sandbox or just a pretty please?

It seems like it's controlled by the Bash tool (https://code.claude.com/docs/en/sandboxing) and then bubblewrap (https://github.com/containers/bubblewrap) on linux and Seatbelt on mac at the system level

Re: Go hard on agents, not on your filesystem

#39

Post by Jach » Sat, Mar 28, 2026, 2:51 AM UTC

I've done some experimenting with running a local model with ollama and claude code connecting to it and having both in a firejail: https://firejail.wordpress.com/ What they get access to is very limited, and mostly whitelisted.

Re: Go hard on agents, not on your filesystem

#40

Post by e1g » Sat, Mar 28, 2026, 2:57 AM UTC

For jailing local agents on a Mac, I made Agent Safehouse - it works for any agent and has many sane default for developers https://agent-safehouse.dev