rusch

Joined 11 months ago

Karma

Submissions

Member since

Dec 5

building https://heist.security/

View on Hacker News

Recent submissions

Comment · 1 month ago

It's at the level where calling it a sandbox is a lie

Comment · 2 months ago

Yes correct. We don't use git hooks so they are globally disabled. I also see they added host worktree mode which could work well with superset since it creates the worktrees.

https://docs.docker.com/ai/sandboxes/workflows/#host-worktre...

Comment · 2 months ago

Currently running codex. I run one sandbox per repo. So I create the sandbox in the repo root. Then it's a custom terminal preset:

sbx run --name "yoursandbox" -- --cd "$PWD"

This boots a sbx session in the worktree directory.

For Claude there is no --cd so it's more hacky, but I solved it by creating a sbx kit with entrypoint script that reads a flag (e.g --cwd) from the terminal preset command and then inside the sandbox cd's there and starts claude.

Comment · 2 months ago

The env var is just a placeholder in the VM, so no real secret is in there.

Comment · 2 months ago

Yes, the stated "target workload"[0] is not what i'm looking for. I want my agent to run for long, spin up dedicated local stack while developing etc.

It seems with gondoling i need to explain the agent to run commands in the sandbox, but then where does the agent run itself?

[0]: https://earendil-works.github.io/gondolin/workloads/

Comment · 2 months ago

The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders.

I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in.

Closest open source I have seen is https://earendil-works.github.io/gondolin but the DX is not as polished. https://exe.dev/ would be perfect but it does not come with outbound firewall.

Does anyone have a better alternative?

Comment · 6 months ago

I wonder when and if microplastics will get it's Asbestos moment. Obviously they are not as carcinogenic, but it seems we don't have the full picture, and microplastics are present at an insanely higher degree than asbestos where.