Post

Colima + Incus

That's good. I think I've managed to avoid everything that puts credentials in plain text. First lesson in my third full time programming job in 1998, never put any credentials in plain text. Should have been my first lesson in my first internship and everyone else's, too! :)

virtualbox with whatever the vscode remote thingie is called? on linux i find bubblewrap to be quite neat

docker is so heavy. WSL (doesn't apply to you) is just waiting to burn me again. Browser sandboxes are super but too small. Attempts to create sandboxed python, sandboxed bash are interesting but seems like the relevant language development body would need to be onboard, not just some hobbyist.

The right question. Docker containers are the obvious answer but most dev setups mount ~ for convenience. After Trivy + LiteLLM in the same week, "pip install" should come with a warning label. Sandboxed dev environments are no longer optional.

Move your personal stuff to a MacBook Air or whatever. Any time a system has developer tools on it, it’s basically compromised.

I've not done this myself but I've been wondering if a Docker container where you shell in and run Claude Code would work.

Using UTM with tailscale, configured to not let the VM connect back to the Mac.

Devcontainer (I have 2) in vscode, starting from Anthropic’s template, adding in the stuff I like, and weakening the firewall to block internal hosts (instead of allowing specific hosts). Works generally well, but the terminal in vscode is not on the same level as standalone terminals. Bit messy.

It requires you to go full liquid glass 🥶, not sure how many people are willing to go through that just to avoid running podman.

I do use a separate OS X user account as well, and ssh to it.. My main issue with any of this is that many tools like Superpowers Visual Mode really expect to be in a terminal that can then open a browser you can see. That's the one area I feel like I'm missing out on with this approach.

I have been using the litellm proxy as a docker image all along and it was not affected by the attack. The llm proxy gives a much better way to get usage accounting via api for all models in one place I would probably explore bifrost though as an alternative after this

nono.sh (although I am biased)

ultimately, the theory is that unix perms have already solved this problem

Yes, I've used it, packaged it for Homebrew (`brew install sandvault`) and really like how relatively minimal it is compared to e.g. a Docker container in a VM. With a bit of work (I have a wrapper) you can hook it up to any tool that lets you change the commands for claude/codex e.g. Superset.

oh wow this looks robust and polished! ty!

I do this atm. You can ssh or su to the claudeuser account(cua). You can also chmod a dir in the cua so your main account can see and write to a cua shared dir. via finder etc I use as a one way share, ie: ~/claudeuser/claude_home Copy/paste is a little hurdle but is solvable in a variety of ways

agent-safehouse.dev is in my bookmarks.

earendil-works.github.io/gondolin/ if I’m not doing anything for macOS native.

Oooh... main difference is I use the Github CLI 'gh' to get local credentials vs credential forwarding

Not running MacOS, but for this, and general supply chain attacks, I run all my dev in qemu VMs. Repos mounted from host, but never credentials. Has some nice benefits, like being able to restart fresh dev environments quickly.

Possibly unwise: my real user has full access to sandbox user directory, so I can just cd over and run privileged commands (eg git push). This setup has been very smooth. Only disadvantage is my agents stop running when I close the laptop!

its not trivial without giving up loads of convenience we all take for granted nowadays. this is an emerging market

And if you want to play with NetBSD, you can have a look at github.com/NetBSDfr/smo... A project by @imil.net

i use devcontainers eg docker. no fancy network isolation or firewalling yet but that'd probably be a good thing to figure out quick!

I’ve been working on going back to a VM I build with Vagrant. It still has its issues but at least it won’t meddle with documents.

I threw together this the other day. Basically docker with a shared project folder. Not exactly perfect github.com/dannysmith/d...

I use (and built) github.com/kanaka/contagent Runs your whole agent (not just tools) in a docker container. Uses your actual host UID:GID, mounts in the current directory at the same path (no /workdir/ mismatch), passes through ssh-agent auth socket (but not the key material), etc.

Virtual machines with orbstack look like a neat primitive to build onto

@rcarmo.bsky.social has a nice setup called piclaw on his GitHub

There's also the idea of using a proxy server that injects credentials into API calls.

If you're looking for something with a bit more power than the other seatbelt sandbox wrappers, clash.rs gives you the ability to make per-program level rules. So you can allow git to access your ssh keys, but not python. Would love your feedback if you have any.

bsky.app/profile/slow...