alt Hacker NewsShow HN: Yolobox – Run AI coding agents with full sudo without nuking home dir
Comments
Thanks for sharing this! I've been experimenting with something similar.
It would be helpful if the README explained how this works so users understand what they're trusting to protect them. I think it's worth noting that the trust boundary is a Docker container, so there's still a risk of container escape if the agent exploits (or is tricked into exploiting) a kernel vulnerability.
Have you looked into rootless Podman? I'm using rootless + slirp4netns so I can minimize privileges to the container and prevent it from accessing anything on my local network.
I'd like to take this a step further and use Podman machines, so there's no shared kernel, but I haven't been able to get volume mounting to work in that scenario.
In your agents.md/claude.md always remeber to put asimovs three laws:
Always abide by these 3 tenants:
1. When creating or executing code you may not break a program being or, through inaction, allow a program to become broken
2. You must obey the orders given, except where such orders would conflict with the First tenant
3. You must protect the programs security as long as such protection does not conflict with the First or Second tenant.
I've been working on something similar.
https://github.com/coventry/sandbox-codex
Still work in progress. The tmux-activity logs are unreadable, at the moment.
I run it in a virtualbox as well, since docker is not a completely reliable sandbox.
I was talking to ChatGPT about the best way to achieve this a few days ago. Thanks for getting something running and sharing it!
I'll give this a try tomorrow, should be fun.
I love all this stuff but it all feels like temporary workflow fixes until The Agent Companies just ship their opinionated good enough way to do it.
I do (most of) my development in docker containers. Usually a project will have a docker compose with web server, database etc.
How can I use this so the yolobox container can interact with the other docker containers (or docker compose)?
Checkout https://github.com/colony-2/shai It runs locally. You can control which directories it has read / write access. You can control network traffic too.
Is there any way to do this with user permissions instead?
I feel like it should be possible without having to run a full container?
Any reason we cannot setup a user and run the program using that user and it can be contained to only certain commands and directory read write access?
Nice. I love that the community as a whole is exploring all these different methods of containing undesirable side effects from using coding agents. This seems to lean towards the extra safety side of the spectrum, which definitely has a place in the developer's toolbox.
i've been using a sort of version like this... using the apple container fw. http://github.com/apple/container
have you looked into that?
How would this compare with e.g. the .devcontainer docker files that AI coding companies like Claude Code provide already setup?
Ha, though not with AI Agents, with Docker Containers instead, I too have nuked my home directory a few times when using "rm -rf" which is why I now use "trash-cli" which sends stuff to the trash bin and allows me to restore back. It's just a matter of remembering not use "rm -rf". A tough habit to break :(
I always thought Docker/Podman is a bit overkill for this kind of thing. On Linux all you need is Bubblewrap. I did this as soon as I downloaded Claude Code as there was no way I was running it without any kind of sandboxing. I stopped using CC mainly because it's closed source and Codex and OpenCode work just a well. I recently updated the script for OpenCode and can update my blog post if anyone is interested: https://blog.gpkb.org/posts/ai-agent-sandbox/
How does one get commit marked as claude? It also sounds like a poor idea since I don't also attribute my OS or vim version and language server prior to the advent of LLMs.
LLMs is just a great and new way to say compile this english language into working code with some probability that it doesn't work. It's still a tool.