Ask HN: Opinionated Agent Setup?

I'd like to dip my toes into more fully autonomous long running agentic coding but I'm put off by thinking through the 'right' way to have it all running. How are you running your agents? What do you do for sandboxing and cost control? How do you handle secrets? Etc.

I've only played around a bit with it, but I've enjoyed using https://vercel.com/eve because of how "batteries included" it is on all the glue code/infra -- borderline just write Markdown skills + configure tools/connectors/schedule/etc, and things just work.

Most developers I know don't seem to care about the "right way" to run agents. They either yolo it on their primary dev machine, or setup a separate box (VM, VPS, Rpi, Mac mini) and let it run there with minimal protection. You could simply do the same, running Hermes or Pi on a VPS (e.g. Digital Ocean). Note that Pi has no protections so you probably ought to take extra steps. Hermes uses a container.

My setup took a long time to build and I don't know any devs personally who go thru the trouble.

* I use a custom harness in a podman container run by a non-sudoer system account. File access is limited to specific ZFS datasets. I don't use Anthropic models for agentic work.

* You can find an open-source network proxy that injects credentials into the network requests, I made a custom one.

   https://github.com/onecli/onecli
   https://github.com/smart-mcp-proxy/mcpproxy-go
   https://github.com/mcpharbour/mcpharbour
   https://github.com/bglusman/calciforge 

* I made a custom shell (nearly posix-compliant) and don't give it access to regular bash, thus no need to filter its shell commands. You could use an open-source one if you care about this: `https://github.com/search?q=agent+bash+shell&type=repositori...`

* Same story for agent memory, context management and token reduction/compression, but this requires a lot of constant tweaking. Again, there are a lot of open-source repos addressing these aspects. Just search github, hn.algolia.com, and/or look at subreddits like /r/agentsofai /r/ai_agents

* Also the agent must be able to run/test the generated code, so if you're targeting another platform you need a MCP or deployment tool that'll allow testing.