Remix.run Logo
creata 5 hours ago

The part that worries me here is the diff. Does it happen in the host or in the guest? What code gets run when you run `yoloai diff`?

kstenerud 5 hours ago | parent [-]

It actually runs git (with hooks disabled) to generate the diff. It happens on the host when using copy mode, and inside the sandbox when using overlay mode.

The above example doesn't specify workdir mounting mode, so it would be copy, not overlay.

creata 5 hours ago | parent [-]

If it runs inside the sandbox and the guest is compromised, can't the guest just lie?

kstenerud 5 hours ago | parent [-]

Absolutely. That's why overlay is not the default.

creata 4 hours ago | parent [-]

That's... uh, an interesting approach to security.

kstenerud 4 hours ago | parent [-]

What is? Defaulting to the most secure method?