[dead]
Go hard on agents, not on your filesystem
301–310 of 374 posts
Re: Go hard on agents, not on your filesystem
#302Installation is a bit... unsupported unless you're on Arch. Here's a Nix setup I (and Claude!) came up with:
https://github.com/pkulak/nix/tree/main/common/jai
Arg, annoying that it puts its config right in my home folder...
EDIT: Actually, I'm having a heck of a time packaging this properly. Disregard for now!
EDIT2: It was a bit more complicated than a single derivation. Had to wrap it in a security wrapper, and patch out some stuff that doesn't work on the 25.11 kernel.
Re: Go hard on agents, not on your filesystem
#303[dead]
Re: Go hard on agents, not on your filesystem
#304[dead]
Re: Go hard on agents, not on your filesystem
#305Earlier quoted context omitted.
I've many times seen Claude try to execute a command that it's not supposed to, the harness prevents it, and then it writes and executes a python script to do it.
breaking a chroot takes more than that..
How much more? Depends on the system doesn't it? I don't know how many systems have proc mounted but don't you get it from /proc/self/root?
Anyway that's beside the point, which is that it doesn't have to "be malicious" to try to overcome what look like errors on its way to accomplishing the task you asked it to do.
Re: Go hard on agents, not on your filesystem
#306Earlier quoted context omitted.
Battle hardened tools for this have existed for decades, we don't need new ones. Just run claude as a user without access to those directories, that way the containment is inherited by subprocesses.
You're not wrong, but this will require file perms (like managing groups) and things, and new files created will by default be owned by the claude user instead of your regular user. I tried this early on and quickly decided it wasn't worth it (to me). Other mileage may vary of course.
True. I just maintain separate /home/claude/src/proj and /home/me/src/proj dirs so the human workspace and the robot workspaces stay separate. We then use git to collaborate.
Re: Go hard on agents, not on your filesystem
#307I am still amazed that people so easily accepted installing these agents on private machines. We've been securing our systems in all ways possible for decades and then one day just said: oh hello unpredictable, unreliable, Turing-complete software that can exfiltrate and corrupt data in infinite unknown ways -- here's the keys, go wild.
I got bad news about all of the other software you're running
Re: Go hard on agents, not on your filesystem
#308From the home page:
> Stop trusting blindly
> One-line installer scripts,
Here are the manual install instructions from the "Install / Build page:
> curl -L https://aur.archlinux.org/cgit/aur.git/snapshot/jai.tar.gz | tar xzf -
> cd jai
> makepkg -i
So, trust their jai tool, but not _other_ installer scripts?
Re: Go hard on agents, not on your filesystem
#309Add this to .claude/settings.json: { "sandbox": { "enabled": true, "filesystem": { "allowRead": ["."], "denyRead": ["~/"], "allowWrite": ["."], "denyWrite": ["/"] } } } You can change the read part if you're ok with it reading outside. This feature was only added 10 days ago fwiw but it's great and pretty much this.
Any way to have it use /Users/claude/*? or something like that
Re: Go hard on agents, not on your filesystem
#310From the home page: > Stop trusting blindly > One-line installer scripts, Here are the manual install instructions from the "Install / Build page: > curl -L https://aur.archlinux.org/cgit/aur.git/snapshot/jai.tar.gz | tar xzf - > cd jai > makepkg -i So, trust their jai tool, but not _other_ installer scripts?
No, no, see this is untrustworthy:
curl -L https://aur.archlinux.org/cgit/aur.git/snapshot/jai.tar.gz | tar xzf - && cd jai && makepkg -i