I guess people are slowly realizing that giving LLMs r/w access to your entire machine is an utterly insane idea.

I did a quick look-around last month and decided to start using bwrap. But manually configuring it on a per-project basis is irritating. So I rolled out something for my own use (+ a couple of friends) based on bwrap.

What I do:

- start with `bwrap --clearenv --unshare-all --die-with-parent --tmpfs / ...`

- every single file and folder and envar I need has to be mapped in. I have profiles in TOML, and `prepare/probe` commands to make this task simpler

- `--tmpfs /` means sandbox inits as `/home/user` on tmpfs unless you specify your own `home` and `user` keys.

- `--unshare-all` means there is no network inside the sandbox. So I used `socat` to run a HTTP/S proxy inside. Lets me control exactly which host+port combinations can be accessed. But this means nothing except HTTP(S) works. So no ICMP/UDP/TCP.

- profiles can be extended via extend syntax (otherwise you have to prepare/probe/manually specify everything per profile which is a nightmare). Which lets me do a base -> net -> coding chain.