coder-pm
Joined 4 months ago
Karma
30
Submissions
81
Member since
Jun 20
Recent submissions
Comment · 1 month ago
Hmm what is this JavaScript sandbox? container, separate process, same Node process? Also does it have access to the MCP tokens? The harness credentials?
Comment · 1 month ago
You should go for it, the egress is becoming something more and more important these days!
Comment · 1 month ago
Being new here doesn't mean I'm a bot. I'm not native and maybe my style looks for you like a bot, I won't try to argue with you. Just wanted to contribute
Comment · 1 month ago
Nice setup, I'm curious about the PAT. Even fine-grained permissions are working till the expiration so if the box will die someone has it for the whole time. Did you rotate it per session or it was on default expiration time?
Comment · 1 month ago
It makes sense for a personal project. The fix should be accomplished as a standalone role or scoped credential per user. Once this is done the prefix will be a real boundary, not just a name. Good luck with that, nice project!
Comment · 1 month ago
If the server is compromised, it still receives the real key on each call. If the vault issues a long lived key, e.g. GitHub PAT, one call will expose it forever. Does the vault issue short lived keys or the stored one?
Comment · 1 month ago
I have read the template and all the microVMs are running under the same role which has read and write access to checkpoints/*, so every user's folder in the bucket. The prefixes for users are just names, not boundaries. What stops one agent to read or overwrite the checkpoints for someone else?
Comment · 1 month ago
This looks like a gate before calling a tool but you’re saying your goal is not to containerise it. In that case what would stop the allowed call from, for example sending something outside? Is there something else sitting alongside the gate? Or is this just out of scope?
Comment · 1 month ago
This makes sense for stateless workers, which don’t have to keep the context between the steps. What about the interactive agents, holding ssh session or repository state between the steps? That’s a different case, isn’t it?
Comment · 1 month ago
That’s kind of similar to what I am doing right now. I’m building a sandbox for agents with egress control using a domains allowlist. Is it possible to control egress in that proxy, per agent, per domain? Or is it giving a full access to the internet once paid?
Experienced software architect, recently associated with a GenAI startup.
Cleat, a Docker sandbox for AI coding agents (MIT):
Blog: dev.to: Not a native speaker but keen to share my knowledge and experience.In case you want to contact me, you can easily Google me by my username.