amazing-sandbox

Dedicated user account does not work as eventually all your code and data will move under that. I run it in an ephemeral container sandbox (https://github.com/ashishb/amazing-sandbox) which has access to the current working directory and it drastically limits the attack radius.

Exactly, that's what I do, I even up end up writing my own for this purpose - https://github.com/ashishb/amazing-sandbox

> Granting terminal full disk access grants arbitrary scripts full disk access. Indeed, I run all dev tools including coding agents inside sandbox now https://github.com/ashishb/amazing-sandbox

Here's another sandbox that I found interesting: https://github.com/ashishb/amazing-sandbox

The archaic model where every tool gets full access to your home directory was never designed for the scenario where a single npm install will install and execute 100s of packages written by various authors. One should sandbox all npm command executions. https://github.com/ashishb/amazing-sandbox

> The repo you’re working on, sure. But all files? Yes, any tool, including any coding agent, has access to all files $USER has access to. Sandbox it explicitly to give access to only the current directory - https://github.com/ashishb/amazing-sandbox

There is a reason I run all such CLIs inside a sandbox [1] giving limited directory access. Imagine if the CLI pulled your SSH keys or other sensitive information by mistake? Programmers do make such mistakes all the time. I don't want to count on whether "uploading all files it can access" is intentional or a mistake. 1 - https://github.com/ashishb/amazing-sandbox

> https://github.com/ashishb/amazing-sandbox Does your Docker backend run commands in rootless containers? I skimmed the code but didn't see anything to confirm this.

Nobody should do 'npm install' or 'pip install' on their machine. Using a proper sandboxing(https://github.com/ashishb/amazing-sandbox) regularly will drastically limit the blast radius of these attacks.

Then try https://github.com/ashishb/amazing-sandbox I use it every day for CLI tools > How would you sandbox an Electron app I haven't figured that out yet

I wrote a Docker-based sandbox [1] for myself last year to control the blast radius of such malicious packages. https://github.com/ashishb/amazing-sandbox

> That is very inconvenient. All executions (especially of random third-party code) inside the containers are not inconvenient at all for me. Infact, I even open-sourced my setup - https://github.com/ashishb/amazing-sandbox

> Yes, but now you are in charge of knowing every potential file access, network access, or possibly even system call, for a program that you do not maintain. Not really. I try to capture the most common ones for caching [1], but if I miss it, then it is just inefficient, as it is equivalent to a cache miss. I'll emphasize again, "no linter/scanner/formatter (e.g., trivy) should need full disk access". 1 - https://github.com/ashishb/amazing-sandbox/blob/fddf04a90408...

I wrote this[1] for myself last year. It only gives access to the current directory (and a few others - see README). So, it drastically reduces the attack surface of running third-party Python/Go/Rust/Haskell/JS code on your machine. 1 - https://github.com/ashishb/amazing-sandbox