fence

I built Fence (https://github.com/Use-Tusk/fence) in Go, a lightweight process sandbox for CLI agents (or any command really) with filesystem and network restrictions. It's also available as a Go library if you wish to add sandboxing to Shelley.

I created a tool for this: https://github.com/Use-Tusk/fence Same thoughts - I wanted a "permission manager" that defines a set of policies agnostic to coding agents. It also comes with "monitor mode" that shows operations blocked, but not quite an audit log yet though.

I built Fence for this! https://github.com/Use-Tusk/fence fence -t code -- opencode

Saw something last week using bubblewrap as well in hn github.com/Use-Tusk/fence

I went down this rabbit hole a bit recently trying to use claude inside fence[0] and it seems that on macOS, claude stores this token inside Keychain. I'm not sure there's a way to expose that to a container... my guess would be no, especially since it seems the container is Linux, and also because keeping the Keychain out of reach of containers seems like it would be paramount. But someone might know better! 0: https://github.com/Use-Tusk/fence

That's acknowledged in the readme though I don't know if there is a comparison https://github.com/Use-Tusk/fence?tab=readme-ov-file#attribu...

Fair point, it does raise the bar! The distinction I'm drawing is between "semi-trusted" and "actively malicious". Fence handles well supply-chain scripts that phone home, tools that write broadly across your filesystem, accidental secret leakage, the "opportunistic" stuff that makes up most real-world supply chain incidents. I hedge on malware because: (1) Domain filtering relies on programs respecting HTTP_PROXY, and malware could ignore it (though direct connections are blocked at the OS level, so they'd fail rather than succeed), (2) OS sandboxes (sandbox-exec, bubblewrap) aren't VM-level isolation and I believe determined attackers could exploit kernel bugs, (3) there are no resource limits or content inspection. The threat model is really "reduce blast radius from code you're running anyway". For a stronger containment boundary you'

Hi HN! Fence wraps any command in a sandbox that blocks network by default and restricts filesystem writes. Useful for running semi-trusted code (package installs, build scripts, unfamiliar repos) with controlled side effects, or even just blocking tools that phone home. > fence curl https://example.com # -> blocked > fence -t code -- npm install # -> template with registries allowed > fence -m -- npm install # -> monitor mode: see what gets blocked One use-case is to use it with AI coding agents to reduce the risk of running agents with fewer interactive permission prompts: > fence -t code -- claude --dangerously-skip-permissions You can import existing Claude Code permissions with `fence import --claude`. Fence uses OS-native sandboxing (macOS sandbox-exec, Linux bubblewrap) + local HTTP/SOCKS proxies for domain fi