exec1

It doesn’t take much effort to remain relatively safe on the internet so you don’t have to resort to dedicated hardware just for banking. Don’t install sketchy apps that you don’t need and stop clicking on every link that you see – that’s pretty much it. I found that this basic internet hygiene has a nice side benefit as well – it forms a habit of avoiding superfluous and/or crappy content altogether.

I’m using this setup for my own projects but I suppose this setup could work in a work context as well if we’re talking about a work laptop with all of the project files already on it. In that case, I don’t see how spinning up a local VM and serving those files to the host would allow for data exfiltration, unless I’m misunderstanding you.

I’ll definitely have to try this. SSHFS didn’t work well for me when sharing files from the host to the guest but it might just work when sharing from the guest

More specifically, I’m having trouble seeing the issue with this approach if you’re, say, working on a laptop that has your project files and decide to spin up a local VM, place the files inside it and share them with the host via NFS/Samba/whatever.

I am the author. :) I’ve clarified my use case at the top of the article. I’m not connecting to remote VMs or anything of the sort, all of this is happening in a local VM so the data exfiltration point does not seem to apply (unless I misunderstood your point).

Yeah, I hear you. I try to avoid pulling NPM packages that I don’t know so I’m not really interested in containing software for security purposes.

Of course, there’s also the question of dependencies. If I’m working on a project that I trust that pulls in hundreds of NPM dependencies, I implicitly trust that the project deemed those dependencies safe to pull in. It would be impossible to always operate on the assumption that you’re potentially pulling in hundreds of malicious packages so the chain of trust has to take over at some point.

However, I imagine you were more or less referring to singular projects that you don’t fully trust and like to experiment with in which case I agree with you and would probably use a VM without any kind of file sharing tbh.

Fair enough. I have clarified my use case at the top of my article to reflect my threat model. I don’t use the VM to run tricksy software I don’t trust so the sandboxing argument doesn’t really apply in my case (or rather it doesn’t apply any more than when running software directly on the host). All of the software I run on my VMs is the same software I would run on my host (if the host was Linux-based).

An addendum: if you’re worried about the guest setting up a malicious git hook that your host would then execute, then your threat model is obviously very different from mine. Perhaps I should have clarified that I’m running code that I trust inside the VM so sandbox escape is not really a security issue in my case (but rather an operational one if, for example, a misbehaving script causes havoc on the host in this way).

Path mapping on PhpStorm was very tricky for me as well (I’m running Docker containers inside my VMs so I had to set up correct mapping in PhpStorm if I wanted to run tests from the IDE) and I’m only talking about regular file paths here (no \\wsl$\ prefixes)…

Correct me if I’m wrong, but isn’t it a bit pointless to worry about data exfiltration when we’re already talking about mounting (and, by extension, sharing) directories?

I wonder how well would this work for things like node_modules?

This doesn’t work for me because I find the Ubuntu desktop experience to be quite horrible. It’s very janky way too often. I very much prefer working with headless Ubuntu instances since this is where Linux excels for my use cases. For GUI stuff I look elsewhere.

My use case is rather specific (web development) and my recommendation is of course not intended to cover all possible use cases. However, if you’re working on web projects and need VMs to isolate your development toolset then this is the approach I choose after years of experimentation.

If I understand you correctly, then yes, I have eventually decided that I should only compromise on performance where it hurts less, e.g. for IDE access. If you’re running your application on a web server inside the VM for example, then this is the place where you probably need the best performance possible since this is where you’re going to feel it the most.