My guideline is nothing can install packages outside of a docker container. For anything on the host, only packages that ship with the default distribution are allowed. This also helps with proper encapsulation of services in a three-tier architecture. Claude always wants to break abstraction layers which leads to 10 different implementations of the same logic in the client besides the increased supply chain risk.
alt Hacker News
My guideline is nothing can install packages outside of a docker container. For anything on the host, only packages that ship with the default distribution are allowed. This also helps with proper encapsulation of services in a three-tier architecture. Claude always wants to break abstraction layers which leads to 10 different implementations of the same logic in the client besides the increased supply chain risk.