Hacker News

I keep seeing projects like this pop up and they never nail it.

I need isolation, but I also need to give my agents secure access to internal package registries, logs, internal infra, designs, emulators, browsers, docs etc. At a large company, work can span dozens of repositories. And on top of that, I need dozens of these.

I built this at work. Engineers use krunkit VMs with proper memory ballooning, GPU acceleration. Retina RDP, credential injecting proxy for etc.

This seems like a fun toy for single project development, but nothing close to what you need as an engineer in a corporate environment.

i just tried this idea today https://github.com/tuananh/fastvm

microvm. build from dockerfile. vm will be paused if idle but can still receive request by waking themselves when a packet arrives — with the frame already queued in the guest's own virtio-net path.

Damn, I've been building something very similar the past few weeks - haven't quite gotten to a public release yet.

Mines based on libvirt and uses cloud-init for creating the images, with shared golden images across projects.

Skimming your docs it wasn't totally clear to me if your images are built per project, or COW from shared toolchains.

Looks like you have a few features in there that I might take some inspiration from though, eg the proxying stuff.

Funny how many of us are trying to solve the same problem at the moment.

I see nothing this brings over smolvm machines. I did not use lima / krunkit outside colima but in colima it was just slow, had outdated devx and was unreliable compared to controlling every detail with an embedded vm library.

One of the fake recruiters contacted me on LikedIN for a Solidity dev role, with an assignment repo that came as a zip in DM. Everything looked fine since Finder only showed .sol files, but Finder doesn't show .git and other hidden folders by default. However .git was there, and it had a hook that ran eval() on a remote address on commit/push.

As I read it, .git protection stops the VM from changing hooks, and --clone leaves the hook behind since a clone doesn't copy hooks. However, the hook is still in the folder on the host. Does devvm inspect and warn when a folder already has hooks before you start?

I tried to develop an electron app this way; ubuntu VM (using qemu/multipass) on macos as host with Intellij IDEA. Couldnt make it work properly. Sure, I can install all the toolchain in the VM, and Intellij would recognize it (they have a “remote dev” setup), but for instance for electron apps you cannot just run a headless vm, and there is no convinient way to make a change in your mac, hot reload in the VM, and interact with the electron app in your mac.

It's probably a fine project, but the instructions are like "trust this thing, give us your login" , which still gets alarm bells ringing in my head pretty fast.

How does it compare to existing similar products?

`sbx`, safehouse and the like

I made something like this at work as a way to spin up multiple dev stacks on the same project. It’s docker based though so not the best isolation.

The problem i having is more workflow related. AI is doing the dev so fast I constantly need to validate different versions and change sets of an app. Git worktrees work for isolating the agents changes but doesn’t solve running multiple instances of a dev server and remembering which one applies to which agent session.

The solution I came up with was throw the code and all tools in a container git branch. Then run a reverse proxy to get <mybranch>.localhost style urls working.

Would be interested to give something like this a shot if it also solves those workflow issues.

This looks quite similar to docker sandbox (sbx). It uses Lima for VMs under the hood. Windows advertised as not supported (Lima is missing features on Windows).

Like Docker Sandbox this meets what I think should be our standards in the AI age: kernel isolation and secret shielding in addition to network and disk isolation.

I have been working on a similar project because I haven't seen one before that to me didn't have security design deficiencies. This project looks to have made good design decisions around security.

The things that are design choices for these tools are

  * agent integration
  * docker image composition
  * are vms more persistent or throw away
  * managing configuration

I just made my own as an excuse to practice my podman skills. It's saved me countless times over and over. It doesn't have git installed at all and doesn't even mount .git so I feel safe nothing can be FUBAR'd.

"You know you should run your code and agents in a sandbox, but most tools need configuration and setup that’s hard to get right."

This is very true. Having been a user of heavily-customised vagrant boxes for a long time I've been spending a fair bit of time lately on updating my skills for this.

But my own stupid old-fashioned view is that it's probably worth learning cloud-init if you never have. Deploy your VMs on your own machine with multipass or whatever, and the same deployment works with little change in the cloud.

That's been the approach I have settled on, but only after a disappointing experience with Apple's "Container Machine" , which is both quite bothersomely insecure by default (your whole home directory? mounted rw? in a VM with an agent? really?) and from there sort of cumbersome/idiosyncratic.

Docker SBX is neat but the Docker account login aspect is annoying to me.

There is an SBX-like example in the Apple Container examples repo:

https://github.com/apple/container-examples/tree/main/contai...

Keep meaning to try it.

There is also workshop recently released by canonical that uses lxd under the hood

https://github.com/canonical/workshop

I use ddev. Works perfect and gives you options for node etc also.

This is also the principle behind exe.dev, which we have been working on for over a year now. You should have lots of VMs.

Should probably add it to the long list of projects here: https://pleasedonotescape.com/

I miss the days when I opened one file at a time in a text editor and there was no version control....

What is old is new again....

If you use cloud, then it is already a VM. If you are local, why not just buy a cheap box....

Cool, but I am not installing a curl script, make it a package through managers.

how is this different from anthropic srt?

thanks but i will just use systemd with linux namespaces.

I'm looking for a solution that lets me experiment with random projects in isolated environments (could be Docker containers or VMs), seamlessly, but I want to run VSCode on my actual machine, and whatever agent extensions.

I tried the remote SSH thing and it's painful to setup. Did anyone find a better solution than scripting a "create Docker container, bind the gpu, bindmount an external directory for data, install code server, etc."?

There are yet thousands of these so-called "sandbox" projects that exists. This one sounds rather really wasteful on resources?

Bubblewrap would just be a better alternative for this.

[flagged]

[dead]