Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop

github.com

Post reply on HN
Print view View original

121–130 of 177 posts

Re: Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop

#121

Post by SwellJoe »

I was using VMs for agents, but wanted something lighter and faster, so I made flar, which bubblewraps the agent, its config/history and the project directory. The agent runs in your usual environment but has no access to anything other than what it's been explicitly granted, short-circuiting prompt injections (or intentional secret exfiltration on the part of the agent or model) as well as any supply chain exploits the agent might accidentally introduce.

https://github.com/swelljoe/flar

It starts instantly, as it's a namespace, rather than a full VM or container that has to be downloaded/built/updated on start.

It defaults to dangerously skip permissions mode, but is much safer than the very porous sandbox the agents provide, and the agent can't reach outside of it even if told to, by the user or a prompt injection.

Re: Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop

#122

Post by qznc »

einhard wrote: post #73

I am certainly no expert in this space so it is quite possible I'm missing something critical, but what seems to work for me is a Podman image I built on my computer with some basic things I need (using OpenCode, but I imagine any other agent could be used instead): FROM docker.io/archlinux:base RUN pacman -Syu --noconfirm && \ pacman -S --noconfirm \ base-devel \ git \ curl \ uv \ opencode && \ pacman -Scc --noconfi…

As opencode is inside your container, credentials and API keys are also inside the container. Prompt injection when your agent fetches some web site could have your agent leak this credentials to someone.

Also, do you restrict networking or does your container have full access to your internal network?

Re: Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop

#124

Post by JeremyNT »

This is the right idea IMO but I don't want to trust a third party tool for it either (no offense OP!).

Ever since I started running coding agents with shell access I've jailed them inside of VMs. Since I run Linux I can just use incus[0] for the VM management layer.

It's extremely simple, and you can vibe code a shell script to customize your workflow in a few minutes.

[0] https://linuxcontainers.org/incus/

Re: Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop

#125

Post by cdata »

If you are a Nix flake enjoyer, I whipped up something similar to this (Claude Code-only right now) based on microvm.nix: https://github.com/cdata/katsuobushi/tree/main/lib/sandbox

Some highlights:

- Drives Claude Code as a quasi-subagent via "Channels," which supports multi-turn interaction with the host and suspend / resume

- Declarative configuration in the flake of exactly what is copied into the VM (besides the local project), what DNS origins are allowed, etc.

- Shared access to host Nix store / object DB via overlay FS

- Syncs code with the host over a shared (local) Git remote (no worktree mess to manage)

- Devshell commands for quickly dropping into the guest and viewing status of all VMs etc.

- VMs start in a couple of seconds

Re: Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop

#127

Post by pmontra »

3form wrote: post #28
vqtska wrote: post #15

I still don't understand the point of all these VMs and containers for agents. Just create a separate user on your machine without sudo privileges, switch to it in your terminal and run all the agents you want without it being able to reach your files. What am I missing?

Well, for one, Debian and Debian-based distros make your home directory readable by everyone by default. Security is riddled by traps. If you can afford best possible level of isolation, why not do it?

Yep, I broke locate when I made my home 700. Its user could not traverse my files anymore. I had to make it run as root. A better design would be to traverse each user home with that user id but apparently it assumes that the home dirs are 755.

Re: Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop

#128

Post by mkagenius »

cdata wrote: post #125

If you are a Nix flake enjoyer, I whipped up something similar to this (Claude Code-only right now) based on microvm.nix: https://github.com/cdata/katsuobushi/tree/main/lib/sandbox Some highlights: - Drives Claude Code as a quasi-subagent via "Channels," which supports multi-turn interaction with the host and suspend / resume - Declarative configuration in the flake of exactly what is copied into the VM (besides the…

If you are into nixos, we at InstaVM have just launched[1] nixos based sandboxes.

1. https://instavm.io/blog/nixos-reproducible-dev-environments-...

Re: Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop

#129

Post by binsquare »

docheinestages wrote: post #89

I think the most secure setup, though not so convenient for the average user, is a separate machine with QEMU/KVM. The machine should be isolated adequately, such that even if compromised, it shouldn't be able to cause damage or gain access to other machines. Additionally, a proxy server on your machine or elsewhere could hide sensitive credentials. A helper binary on your computer would then control spawning new dis…

I agree with this, virtual machines are invented to solve the sandboxing/multi-tenant issues.

This is why ec2 and the likes all sell you access to virtual machines (dividing up their underlying hardware).

Re: Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop

#130

Post by snowstormsun »

arjie wrote: post #115

I just use kubernetes with a single PVC for the Claude folders. Works like a charm. Don’t need too much else. You can then start separate pods with different PVCs to different folders. Lives on a server, I can manage the auth by just making each pod description different. Honestly works fine and you can use /rc to talk to them over the Claude phone app.

Amazing idea! Need to try that.
Post reply on HN