alt Hacker NewsThe first step is building a sandbox (vm, container, whatever) that allows you to trust the agent in its most permissive mode.
This varies based on the maturity of my projects but most of my sessions live in VMs with very specific egress rules and permissions.
Replies
ryandrake • yesterday at 2:15 AM
I think this is an area where the developers of the agent harnesses should be spending a lot of effort. It's not reasonable to expect your users to set up and maintain a VM just to safely use a tool. When I run cmake, I don't have to worry about it accidentally deleting my root filesystem or posting my account credentials to github. Most of the command line coding tools I use don't even need/have a --dry-run option.
➕ show 1 reply
Frustratingly none of the coding harnesses seem to default to just firing up a docker container with the working directory mounted and letting the AI run wild inside the container.