Post

I've been running coding agents in VMs, and the worst part was always credentials. Either I pasted a token into the VM and hoped, or I did everything myself. So I built foca. It's basically ssh-agent for secrets: the VM asks, I tap Touch ID, it gets the token. github.com/bpinto/foca

skilldb.bsky.social

@skilldb.bsky.social

Nice, the unverified label is the right call. One thing to check is whether a grant gets reused silently across sessions, since that's where these usually erode.

Bruno Pinto

@bpinto.com

Grant reuse is off by default, but you can specify a grant duration where every binary on the guest would be able to use that grant, unfortunately there is no way to avoid. For that, the best is to use the default and have to grant on every invocation.

12/10/26, 4:47 pm0 reposts0 likes

No replies yet.