141–150 of 177 posts
We need an agentic platform that has sandboxing built-in well. Giving agents a disposable VM is nice but I'm already hitting my Mac mini's space limit.
This ensures you no longer fear --dangerously-skip-permissions and stop babysitting agents
What else would you want to see in this project? Please star the repo, if you like the idea :)
With agentjail ( https://github.com/LuD1161/agentjail ), I've tried to contain coding agents in os-native sandboxes (sbpl for macos and similarly for linux, Protocol aware network proxy coming soon Then you can match a DSL and block particular network requests. This ensures you no longer fear --dangerously-skip-permissions and stop babysitting agents What else would you want to see in this project? Please star the re…
I think the most secure setup, though not so convenient for the average user, is a separate machine with QEMU/KVM. The machine should be isolated adequately, such that even if compromised, it shouldn't be able to cause damage or gain access to other machines. Additionally, a proxy server on your machine or elsewhere could hide sensitive credentials. A helper binary on your computer would then control spawning new dis…
I use vagrant on a seperate machine in a seperate network. The magic of ssh makes it transparent for me, and I feel pretty sure the agents cannot get to stuff that matters.
With agentjail ( https://github.com/LuD1161/agentjail ), I've tried to contain coding agents in os-native sandboxes (sbpl for macos and similarly for linux, Protocol aware network proxy coming soon Then you can match a DSL and block particular network requests. This ensures you no longer fear --dangerously-skip-permissions and stop babysitting agents What else would you want to see in this project? Please star the re…
I am certainly no expert in this space so it is quite possible I'm missing something critical, but what seems to work for me is a Podman image I built on my computer with some basic things I need (using OpenCode, but I imagine any other agent could be used instead): FROM docker.io/archlinux:base RUN pacman -Syu --noconfirm && \ pacman -S --noconfirm \ base-devel \ git \ curl \ uv \ opencode && \ pacman -Scc --noconfi…
As opencode is inside your container, credentials and API keys are also inside the container. Prompt injection when your agent fetches some web site could have your agent leak this credentials to someone. Also, do you restrict networking or does your container have full access to your internal network?
I don't use Claude or any other paid agent at the moment, so if that were to change I'd probably modify the way I run this, but with this simple set up I'm not too worried about credentials leaking.
We need an agentic platform that has sandboxing built-in well. Giving agents a disposable VM is nice but I'm already hitting my Mac mini's space limit.
We need an agentic platform that has sandboxing built-in well. Giving agents a disposable VM is nice but I'm already hitting my Mac mini's space limit.
Earlier quoted context omitted.
Huh. My virtdev project implements nearly all of that... Except credential injection from the host, which turned out to be on my TODO list.
Based on the readme in your project, yours does not include 1) a policy engine, 2) application proxies to limit scope of access to external systems/networks, 3) firewall configuration for commonly accessed package repositories, 4) configuration management, 5) credential management. You do have some scripts that 'diff' package inventory of the one distro you support, but not a full fledged configuration management sys…
You substituted in application proxies and firewalls for package repositories. Implementing those is what I came to this thread for. Already planning a custom network stack to replace passt. It will have those features soon. Credential management too.
> It doesn't do anything all the other solutions don't already do
That's just false. I built virtdev because I literally didn't find any other tool that implemented KVM virtualization, cheap expendable contextual VMs and configurable egress firewall with minimal, soon to be zero root access requirements. Virtdev also manages daemon life cycle correctly via user mode systemd, which is something I just don't see other projects do.
Vagrantfile and OS agnosticism are not why I built virtdev. Vagrant has no security focus at all, and I explicitly opted out of declarative YAML because GitHub Actions is painful enough.
> since it's not built-in
By this logic, no composable tool has any value. I chose to provide mechanism, not policy. The primitives are there.
> it's another component the user will need to bring with them
Yes, as files committed to a dotfiles repository. A one time configuration.