| ▲ | denysvitali 2 days ago | |
I've created boxy [1] to sandbox the agents via Landlock and gh-proxy [2] to not share GH PATs that might leak over the internet. I have a far better setup on my Kubernetes cluster [3], but these are good building block (IMHO) to start preventing these kind of issues. I also "recklessly" run `claude` / `codex` as root for certain things - but that happens on a completely separate machine that is meant to be pruned afterwards, and it's what unlocks the kernel development feedback loop that is needed to port a device (such as the Daylight DC-1 / Surface Pro X) to mainline Linux. [1]: https://github.com/denysvitali/boxy [2]: https://github.com/denysvitali/gh-proxy | ||