yoloai

I put a reference to AGENTS.md in the CLAUDE.md file, and then put Claude specific stuff (mainly info about hooks and scripts) after that. https://github.com/kstenerud/yoloai/blob/main/CLAUDE.md

The rule I set for linting when an LLM is writing code is: Either you adhere to the rules, or you mark an exception with a valid reason. https://github.com/kstenerud/yoloai/blob/main/docs/contribut... Poor defaults break systems by a thousand cuts. They seem to make sense when designing the language (more convenient, less typing, etc), but then they very quickly become liabilities as project complexity increases. Go made the mistakes of mutable-by-default and silent-error-dropping, but their cyclical-import-forbidding was a good call.

I wrote one that has both of those: yoloAI (MIT, Go, single binary, no login). https://github.com/kstenerud/yoloai Outbound firewall is `--network-isolated`: egress is denied except the agent's own API endpoints plus domains you allow, enforced sandbox-side (working on host-side enforcement now). `--network-none` if you want nothing. Credential brokering works the way you describe (currently Claude-only, I'll add more as time allows). The API key stays on the host, a local proxy injects it into the outbound request, and the sandbox never holds anything worth stealing. Other agents' credentials currently arrive as read-only file mounts instead (weaker, and something I'll fix soon). Generalising the injector is the obvious next thing. One difference from your setup: yoloAI copies your worktree instead of mounting it. The agent works on the

I am developing a project that makes running in Apple Container (Docker is an alternate runtime for Linux) more convenient: https://github.com/gregwebs/claude-contained/ It blocks network access by default, mounts only what you specify, and you can add a customization layer. This is all done in the container itself (srt for network blocking). It doesn't implement a central point for secret sharing, MCP exposure, etc. So it might not have enough features for some but it works well for my needs. I just found through this thread yoloai which has an apple container backend, so its quite similar using that. My main issue would be that network access is allowed by default. https://github.com/kstenerud/yoloai Several other projects listed here use libkrun which is an alternate implementation that works with Mac's HVF. smolvm, microsandbox, podma

Permission prompts is a TERRIBLE model, and never should have existed. This is one of the reasons that led to the development of yoloAI: - No permission prompts. The agent has free reign and never has to ask permission, but is in a sandbox. - Sandbox on Linux using Docker, Podman, containerd, gVisor, Kata, Firecracker - Sandbox on Mac using Docker (Docker Desktop or Orbstack), Podman, Apple containers, Seatbelt, Tart (Tart lets you run simulators). - Network control - Secrets control (file mounts or credentials broker) - NO ambient data (ENV is replaced with a minimal and local-to-sandbox one) - NO access to your homedir. You have to explicitly mount things you want. - NO direct access to your workdir: You can get a diff of the changes the agent made, and then choose whether to apply them. - gitignored files never get copied in. The agent

I've already explained in some sister comments. Sandboxing is one of those things that seems very simple on the surface, and is EXTREMELY complicated once you start actually digging into the implications, gotchas, and security issues. The underlying tools were never designed with this use case in mind, so they need a little help to reach that last mile. And this glue is where all the chaos ensues. Here's a small sample of the crazy shit you have to deal with: https://github.com/kstenerud/yoloai/blob/main/docs/contribut... And that's if you're actually following the proper procedures (which are themselves byzantine and tricky to get right).

I designed it to provide a single interface to agent sandboxing, no matter how far up the security tower you want to go. It eliminates the manual process steps you end up doing with an ad-hoc system (which gets old the 10th time you do it). Common weak points: - The agent can access your homedir. - The agent can access .gitignored files, which can contain secrets (and are gitignored for this reason). - The agent has r/w access to your workdir. - The agent could follow your remote mounted dirs. - The agent can act in your name with whatever credentials it finds (and it will use them when it tries to be helpful, especially with the gh tool). - Do you even know what's in the diagnose_problem.sh file it just created and asked permission to run? - Even the .git dir can be weaponized, such as with evil filters. - The agent can edit its own proc

Sandboxing is a VERY HARD problem. I've been working on it for months, and finally have something that's mostly there: - Sandbox on Linux using Docker, Podman, containerd, gVisor, Kata, Firecracker - Sandbox on Mac using Docker (Docker Desktop or Orbstack), Podman, Apple containers, Seatbelt, Tart (Tart lets you run simulators). - Network control - Secrets control (file mounts or credentials broker) - NO ambient data (ENV is replaced with a minimal and local-to-sandbox one) - NO access to your homedir. You have to explicitly mount things you want. - NO direct access to your workdir: Your work dir is never modified until you apply the changes, either standalone or as a git commit. You can also diff before applying. Git runs sandbox side in case the repo has filters. - gitignored files never get copied in. The agent never sees them. - Has b

Yup, I built one! https://github.com/kstenerud/yoloai You can even run simulators in it if you choose the Tart backend.

I built yoloAI for this kind of nightmare scenario (among others). - The sandboxed agent has no access to your homedir, or ANY dir on your machine except what you explicitly give it access to. - Even with your workdir, it honors .gitignore and refuses to copy in any ignored paths to the sandbox copy. - The sandboxed agent doesn't have access to your ENV (unless you explicitly pass things through one-by-one). - Networking can be restricted any way you like. - Credentials are proxied (currently Claude only), so the agent has access to NO secrets at all. - You pick the security backend to match your needs (containers, VMs, etc). - It's FOSS. https://github.com/kstenerud/yoloai

yoloAI does something similar: - Sandbox on Linux using Docker, Podman, containerd, gVisor, Kata, Firecracker - Sandbox on Mac using Docker (Docker Desktop or Orbstack), Podman, Apple containers, Seatbelt, Tart (Tart lets you run simulators). - Network restriction - Secrets control (file mounts or credentials broker) - NO ambient data (ENV is replaced with a minimal and local-to-sandbox one, no host-side filesystem access beyond what you explicitly allow) - Workdir protection: Your work dir is never modified until you apply the changes, either standalone or as a git commit. You can also diff before applying. Git runs SANDBOX side in case the repo has filters. - Uses copy-on-write if your filesystem supports it (most modern ones do) - Has built-in support for claude, codex, gemini, aider, and opencode, but you can also launch it in "shell"

Have you seen https://news.ycombinator.com/item?id=48892015 and yoloai? https://github.com/kstenerud/yoloai Seems like both projects are following very similar approaches.

I made a tool that creates sandboxes (docker, podman, orbstack, seatbelt, tart, Apple containers, containerd, kata, firecracker) and then sets up an agent (claude, codex, gemini, aider, opencode) inside it with max permissiveness (no prompts to call sed, etc). It creates a CoW copy of your workdir for the agent to play in, and then you pull changes out using git diff/apply semantics. You control network access, secrets, which files/dirs it has access to. It's a MASSIVE time saver, and I use it as my daily driver. https://github.com/kstenerud/yoloai

You might want to give https://github.com/kstenerud/yoloai a try, then. Runs agents in tmux in sandboxes.

The biggest public thing I'm working on is an AI sandbox tool that keeps it separated from your system and secrets. Changes the AI makes to the "workdir" are extracted via diffs or git commits, so you can see what the AI did before deciding if you want it or not. It has no access to your home dir, no access to your env, and you can restrict its network access. Containment can be container or VM level, with a Linux or MacOS contained environment. https://github.com/kstenerud/yoloai