Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Running Claude Code dangerously (safely)

blog.emilburzo.com

Post reply on HN
Print view View original

211–220 of 265 posts

Re: Running Claude Code dangerously (safely)

#211

Post by tstrimple »

progval wrote: post #18
gregoriol wrote: post #8

Earlier quoted context omitted.

This breaks the non-interactive mode the post want to achieve. Claude will not be able to install some things and will require user action, which is not desired here.

Like what? It can already use npm/pip/etc. And if it needs a new APT package or config in /etc/ then you would want to know because you need to document it.

Claude Code on NixOS feels like it has super powers. Being able to spin up a nix-shell with needed dependencies on demand gives it access to all sorts of tools I don't have or want installed on my base system. My "book-recommendation" claude code uses sqlite to manage my reading history and to-read and maybe-read lists but I never installed tools for sqlite and they aren't present on my NixOS desktop. It just launches a nix-shell with sqlite anytime it needs to read/modify the database. As long as the database file is within the directory claude code was launched from, it doesn't need to prompt for permission. With the caching that NixOS does, it's fast enough to not even think about.

Re: Running Claude Code dangerously (safely)

#214

Post by srini-docker »

Hey - Srini from Docker here. We’ve seen a lot of developers turn to Docker for this use case and heard some mentions of the Docker-in-Docker block. We put out Docker Sandboxes in experimental preview as a potential answer. Still early but we're working on the next iteration based on MicroVMs and avoids Docker-in-Docker.

Re: Running Claude Code dangerously (safely)

#215

Post by embedding-shape »

lucasluitjes wrote: post #208
embedding-shape wrote: post #188

Earlier quoted context omitted.

Doesn't this assume you bi-directionally share directories between the host or the VM? Or how would the AI inside the VM be able to write to your .git repository or Vagrantfile? That's not the default setup with VMs (AFAIK, you need to explicitly use "shared directories" or similar), nor should you do that if you're trying to use VM for containment of something. I basically do something like "take snapshot -> run tin…

It's the default behaviour for Vagrant. You put a Vagrantfile in your repo, run `vagrant up` and it creates a VM with the repo folder shared r+w to `/vagrant` in the VM.

That's because Vagrant isn't "VM", it's a developer tool you use locally that happens to use VMs, and it was created in a era where 1) containers didn't exist as they do today, 2) packaging and distribution for major languages wasn't infected with malware and 3) LLM agents now runs on our computers and they are kind of dumb sometimes and delete stuff.

With new realities, new workflows have to be adopted. Once malware started to appear on npm/pypi, I started running all my stuff in VMs unless it's something really common and presumed vetted. I do my banking on the same computer I do programming, so it's either that or get another computer.

Re: Running Claude Code dangerously (safely)

#216

Post by Tossrock »

hu3 wrote: post #206
Nition wrote: post #202

Earlier quoted context omitted.

I'm currently stuck on Windows, but I thought sandboxing was built in to Claude Code as a feature on Linux with the /sandbox command?

For Windows a quick win is to install VMware Workstation Pro (which is free) and install Ubuntu 24.04 LTS as a VM. Broadcom bought VMware then released Workstation Pro for free and I don't think they kept the download link but you can get from TechPowerUp: https://www.techpowerup.com/download/vmware-workstation-pro/ You can then let LLMs on YOLO mode inside it.

Windows has the WSL for native Linux vms, these days (and also the past ~decade)

Re: Running Claude Code dangerously (safely)

#217

Post by dragonwriter »

hu3 wrote: post #206
Nition wrote: post #202

Earlier quoted context omitted.

I'm currently stuck on Windows, but I thought sandboxing was built in to Claude Code as a feature on Linux with the /sandbox command?

For Windows a quick win is to install VMware Workstation Pro (which is free) and install Ubuntu 24.04 LTS as a VM. Broadcom bought VMware then released Workstation Pro for free and I don't think they kept the download link but you can get from TechPowerUp: https://www.techpowerup.com/download/vmware-workstation-pro/ You can then let LLMs on YOLO mode inside it.

What is the advantage of using VMware Workstation Pro for this as opposed to using WSL2?

Re: Running Claude Code dangerously (safely)

#218

Post by wilsonnb3 »

snowmobile wrote: post #121

Bit of a wider discussion, but how do you all feel about the fact that you're letting a program use your computer to do whatever it wants without you knowing? I know right now LLMs aren't overly capable, but if you'd apply this same mindset to an AGI, you'd probably very quickly have some paperclip-maximizing issues where it starts hacking into other systems or similar. It's sort of akin to running experiments on con…

Programs can’t want things, it’s no different than running any other program as your user

Re: Running Claude Code dangerously (safely)

#219

Post by TheTaytay »

dragonwriter wrote: post #217
hu3 wrote: post #206

Earlier quoted context omitted.

For Windows a quick win is to install VMware Workstation Pro (which is free) and install Ubuntu 24.04 LTS as a VM. Broadcom bought VMware then released Workstation Pro for free and I don't think they kept the download link but you can get from TechPowerUp: https://www.techpowerup.com/download/vmware-workstation-pro/ You can then let LLMs on YOLO mode inside it.

What is the advantage of using VMware Workstation Pro for this as opposed to using WSL2?

I think it has default access to your c drive via a mount, for one. You could add layers/sandboxes, but it’s not isolated.
Post reply on HN