Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Go hard on agents, not on your filesystem

jai.scs.stanford.edu

Post reply on HN
Print view View original

251–260 of 374 posts

Re: Go hard on agents, not on your filesystem

#251

Post by torginus »

giancarlostoro wrote: post #95
mazieres wrote: post #57

Earlier quoted context omitted.

I've seen claude get confused about what directory it's in. And of course I've seen claude run rm -rf *. Fortunately not both at the same time for me, but not hard to imagine. The claude sandbox is a good idea, but to be effective it would need to be implemented at a very low level and enforced on all programs that claude launches. Also, claude itself is an enormous program that is mostly developed by AI. So to have…

In my opinion Claude should be shipped by a custom implementation of "rm" that Anthropic can add guardrails to. Same with "find" surprised they don't just embed ripgrep (what VS Code does). It's really surprising they don't just tweak what Claude uses and lock it down to where it cannot be harmful. Ensure it only ever calls tooling Claude Code provides.

Why cant you ship with OverlayFS which actually enforces these restrictions?

I have seen the AI break out of (my admittedly flimsy) guards, like doing simply

safepath/../../stuff or something even more convoluted like symlinks.

Re: Go hard on agents, not on your filesystem

#254

Post by schaefer »

diego_sandoval wrote: post #108
schaefer wrote: post #93

Ugh. The name jai is very taken[1]... names matter. [1]: https://en.wikipedia.org/wiki/Jai_(programming_language)

Jonathan Blow has said that "Jai" is just a placeholder name or something.

I hadn’t heard that. Thanks

Re: Go hard on agents, not on your filesystem

#256

Post by jmogly »

100721 wrote: post #243
mcv wrote: post #197

Earlier quoted context omitted.

Isn't this already possible? Give it its own user account with write access to the project directory and either read access or no access outside it.

I have been putting my agents on their own, restricted OS-level user accounts for a while. It works really well for everything I do. Admittedly, there’s a little more friction and agent confusion sometimes with this setup, but it’s worth the benefit of having zero worries about permissions and security.

Haha, you can already see wheel reinventors in this thread starting to spin their reinvention wheels. Nice stuff, I run my agents in containers.

Re: Go hard on agents, not on your filesystem

#259

Post by Tepix »

AnotherGoodName wrote: post #15

Add this to .claude/settings.json: { "sandbox": { "enabled": true, "filesystem": { "allowRead": ["."], "denyRead": ["~/"], "allowWrite": ["."], "denyWrite": ["/"] } } } You can change the read part if you're ok with it reading outside. This feature was only added 10 days ago fwiw but it's great and pretty much this.

Cool. Does opencode.ai have such a feature also (sandboxing with bubblewrap)?

Re: Go hard on agents, not on your filesystem

#260

Post by lemontheme »

pbowyer wrote: post #172
lemontheme wrote: post #164

And for the macos users, I can’t recommend nono enough. (Paying it forward, since it was here on HN that I learned about it.) Good DX, straightforward permissions system, starts up instantly. Just remember to disable CC’s auto-updater if that’s what you’re using. My sandbox ranking: nono > lima > containers.

This nono? https://github.com/always-further/nono > Just remember to disable CC’s auto-updater if that’s what you’re using. Why?

Might be something specific to my and my colleagues' systems, but it breaks the TUI. It needs git authentication, which fails, and the TUI stops accepting input reliably
Post reply on HN