alt Hacker NewsDedicated user account does not work as eventually all your code and data will move under that.
I run it in an ephemeral container sandbox (https://github.com/ashishb/amazing-sandbox) which has access to the current working directory and it drastically limits the attack radius.
Replies
JoBrad • yesterday at 6:07 PM
I’m fine with that. I use a top-level directory for all of my code, and restricting extension access to that directory is a great idea.
➕ show 1 reply
hobo123 • yesterday at 4:01 PM
That looks really nice, including the VSCode/Mac wrapper.
If all the code and data eventually move into the dedicated user account, why wouldn't it also eventually move into the container/vm?