Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop

github.com

Post reply on HN
Print view View original

41–50 of 177 posts

Re: Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop

#41

Post by 0xbadcafebee »

bpavuk wrote: post #23
vqtska wrote: post #15

I still don't understand the point of all these VMs and containers for agents. Just create a separate user on your machine without sudo privileges, switch to it in your terminal and run all the agents you want without it being able to reach your files. What am I missing?

you can also simply use Landlock and bwrap on Linux. Pi even has a plugin for that https://pi.dev/packages/pi-landstrip

Actually that doesn't just work on all systems and it breaks on others. The alternate user is actually guaranteed to work on all systems and it's built in

Re: Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop

#42

Post by vqtska »

matheusmoreira wrote: post #29
vqtska wrote: post #15

I still don't understand the point of all these VMs and containers for agents. Just create a separate user on your machine without sudo privileges, switch to it in your terminal and run all the agents you want without it being able to reach your files. What am I missing?

You're missing the fact you'd be sharing a kernel with the sandboxed agent. Virtualization presents an infinitely smaller attack surface.

What kind of things are you even doing that the agent would try to perform a kernel exploit on you? I thought sandboxing is just to protect from the agent accidentally clearing your home directory.

Side note, just 6 days ago a Linux VM escape exploit was disclosed.

Re: Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop

#43

Post by westurner »

matheusmoreira wrote: post #5

> clawk forward add my-project 3000 > clawk network allow my-project api.example.com Can you describe the implementation details? How did you implement the firewall without root? I vibecoded virtdev, a virtual machine orchestration project just like this one: https://github.com/matheusmoreira/virtdev It was designed to not require root, and the nftables firewall ended up becoming the only exception. I'm very curious…

(Years ago I had puppet and cobbler provisioning VMs over PXE and then iPXE. FWIU foreman is more actively maintained than cobbler, which is built on Django web framework.)

Vagrant manages VMs and virtual networks, in Ruby.

ansible-molecule creates, converges, and destroys VM(s) and containers, in order to test ansible playbooks and ansible roles in clean build roots.

podman machine manages VMs:

- podman-container-tools/podman-machine-os: machine image files: https://github.com/podman-container-tools/podman-machine-os/...

`podman kube play` over `podman machine` might solve for agents that need multiple VMs/containers

- Podman Desktop can work with the same local k8s setups as Docker Desktop. Though there's certainly more state to manage with k8s for agent session farm, k8s probably has better logging and quotas than a VM management script on each node.

OpenShift on OpenStack is one way to do containers over VMs over bare metal.

Microshift also does container-selinux.

There is not an apparmor policy set for containers?

bwrap and liboverlayfs and libseccomp are almost but not quite containers.

There are stronger container isolation layers that are more like a full or lightweight VM, that might be better for agent sessions: gVisor, firecracker vm, Todo

Cloudflare workerd is the open source part of cloudflare workers, which run lightweight WASM and JS VMs with multi-tenant isolation.

It takes far less resources to run a cloudflare worker than to run a container on cloudflare. So, if it's possible for an agent to operate within a WASM runtime ~container, that's probably more optimal for agent sessions.

Cloudflare/artifact-fs does lazy shallow git clones with a FUSE filesystem.

- "Show HN: VM-curator – a TUI alternative to libvirt and virt-manager" https://news.ycombinator.com/item?id=46750437

https://news.ycombinator.com/item?id=46825026 ; amla sandbox, agentvm, ARM64 MTE

https://news.ycombinator.com/item?id=46825119 ; container2wasm , vscode-container-wasm-gcc-example ; build WASM containers with Dockerfiles

docker and podman support multiple WASM runtimes for running WASM containers, e.g. for agent sessiobs

Re: Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop

#46

Post by wilkystyle »

killerstorm wrote: post #39
vqtska wrote: post #15

I still don't understand the point of all these VMs and containers for agents. Just create a separate user on your machine without sudo privileges, switch to it in your terminal and run all the agents you want without it being able to reach your files. What am I missing?

Privilege escalation (e.g. setuid), world-readable files might contain sensitive data, world-writeable files, unrestricted network access (including access to all locally running services)... If you have fully patched system without zero-days and it's configured in a perfect way, then, sure... Container is quite like a "separate user" except you can explicitly define what it can access. (Even if all your daemons have…

Also, many of these sandboxing solutions provide features like network allowlists and credential masking/injection

Re: Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop

#48

Post by matheusmoreira »

hwc wrote: post #35
matheusmoreira wrote: post #24

Earlier quoted context omitted.

Because that means you are sharing kernel with the sandboxed agent. Virtualization presents an infinitely smaller attack surface.

If there is any attack surface within a properly-configured container, that's a kernel bug, right?

Probably. If I remember correctly, containers on Linux are implemented using the kernel's namespaces. The same ones which became famous for the vulnerabilities they surfaced in previously unexercised code.

Re: Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop

#50

Post by killerstorm »

bpavuk wrote: post #23
vqtska wrote: post #15

I still don't understand the point of all these VMs and containers for agents. Just create a separate user on your machine without sudo privileges, switch to it in your terminal and run all the agents you want without it being able to reach your files. What am I missing?

you can also simply use Landlock and bwrap on Linux. Pi even has a plugin for that https://pi.dev/packages/pi-landstrip

Codex uses bwrap sandbox which is purely cosmetic - out-of-box it sees your ssh keys and can send it to remote server. It prevents agent from deleting outside files by mistake, but does nothing against malicious activity
Post reply on HN