legobeat

l7-devenv

JavaScript2024–2025

legobeat / l7-devenv

l7-devenv

Secure terminal-based IDE for local JS development

Explore on GitHub Read Hacker News discussions

2Distinct people

8Mentions

0Explicit recommenders

27GitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

Secure terminal-based IDE for local JS development

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by month8 dated mentions

Observed mentions: 2024-07-04 02:08:45 UTC to 2025-02-10 20:51:02 UTC.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Submissions	Comments
Jul 2024	2024-07-01 00:00:00 UTC	2024-08-01 00:00:00 UTC	4	1	3
Aug 2024	2024-08-01 00:00:00 UTC	2024-09-01 00:00:00 UTC	1	0	1
Sep 2024	2024-09-01 00:00:00 UTC	2024-10-01 00:00:00 UTC	0	0	0
Oct 2024	2024-10-01 00:00:00 UTC	2024-11-01 00:00:00 UTC	2	0	2
Nov 2024	2024-11-01 00:00:00 UTC	2024-12-01 00:00:00 UTC	0	0	0
Dec 2024	2024-12-01 00:00:00 UTC	2025-01-01 00:00:00 UTC	0	0	0
Jan 2025	2025-01-01 00:00:00 UTC	2025-02-01 00:00:00 UTC	0	0	0
Feb 2025	2025-02-01 00:00:00 UTC	2025-03-01 00:00:00 UTC	1	0	1

What Hacker News says

8 sources

flubbergusto·Feb 10, 2025

I think containers is the way to go. Maybe on top of VM (defense in depth-swiss-cheese is the only way to go imo). Something like Qubes can be great for VMs. https://github.com/legobeat/l7-devenv/pull/153 This works for me (which I do run in VMs also, yes). A key thing is some secrets like GH token and signing keys are not available even for the IDE and code in the environment requiring them. Like a poor-mans HSM, made for dev, kinda. Also LLM assistant gets access to exactly what it needs. No more, No Less. You can have your cake and eat it too. https://github.com/legobeat/l7-devenv

In Fake VS Code Extension on NPM Spreads Multi-Stage Malware

legobeet·Oct 31, 2024

I'm going the container route. To get the full seamlessness you're alluding to (easily switch between multiple parallel environments; easy migrations) still requires some additional features but perhaps you can find some inspiration. https://github.com/legobeat/l7-devenv E.g. https://github.com/legobeat/l7-devenv/pull/144 https://github.com/legobeat/l7-devenv/pull/153

In Zed: SSH Remoting Is Here

legobeet·Oct 25, 2024

In a similar vein but still containers and a bit more targeted: http://github.com/legobeat/l7-devenv I daily-drove NixOS for a few years and philosophically very much vibe with the foundational ideas. Gave up on it because it was too much involved in getting productive with writing and maintaining nix configurations.

In Flox, a better alternative to Dev Containers

legobeet·Aug 19, 2024

A defense-in-depth approach with a special eye to compartmentalization/separation/sandboxing coupled with principle-of-least privilege is a good stance to take, I think. Also keep in mind that "security is a process, not a product". There is no silver bullet no tool will save you from yourself... With this in mind: - https://qubes-os.org - Use separate VMs for separate domains. Use disposable VMs for temporary sessions. - https://github.com/legobeat/l7-devenv - My project. Separate containers for IDE and (ephemeral) code-under-test. Transparent access to just the directories needed and nothing else, without compromising on performance and productivity. Separation of authentication token while transparent to your scripts and dev-tools. Editor add-ons are pinned via submodules and baked into the image at build-time (and easy to update on a

Read the rest

rebuild). Feedback very welcome! - In general, immutable distros like Fedora Silverblue and MicroOS (whatever happened to SUSE ALP?) also worth considering, to limit persistence. Couples well with a setup like the one I linked above. - Since you seem to be in a Node.js context, I should also mention @lavamoat/allow-scripts (also affiliated via $work) as something you can consider to reel in your devDeps: https://github.com/LavaMoat/LavaMoat/tree/main/packages/allo...

In Ask HN: Pragmatic way to avoid supply chain attacks as a developer

legobeet·Jul 30, 2024

The next step is to actually use underprivileged canary tokens on the client for your day-to-day work, intercept them with a proxy, and replace them with the real deal in a more isolated setting. For example, an application-specific HTTP proxy for your GITHUB_TOKEN. You can use a canary token for the internal user-facing auth. https://github.com/legobeat/git-auth-proxy [0]. That piece is being used here[1] in order to make it transparent for the user and I intend to add more features there for credentials- and secrets compartmentalization. Been keeping it fairly structured so you could also use it as a reference if you ever do similar stuff and want some inspiration or copypasta for your personal hacking. [0]: Caveat: The proxy repo is a fork and the documentation is still more reflective of the previous owners intentions. I ripped out al

Read the rest

l the Azure/k8s integrations. [1]: https://github.com/legobeat/l7-devenv/

In Canarytokens: Honeypot for critical credentials, get notified when they are used (2015)

legobeet·Jul 21, 2024

Here's a batteries-included local-first dev-environment which does that in order to compartmentalize your credentials: https://github.com/legobeat/l7-devenv Something like Lokal might till be useful here to facilitate remote collaboration by providing a tunnel (ie I can connect to your local session behind NAT without you opening ports or connect to VPNs etc).

In Show HN: I made a tool to HTTPS your localhost

legobeet·Jul 8, 2024

The security side of free editors and IDEs is not great anywhere today for JS development. Once you start wanting more features and integrations, you start facing an apparent choose-any-2 of security, convenience, and productivity. I don't think it has to be this way. I think we can have both better compartmentalization and tighter workflow integration without having it becoming a part-time job. Here is my ongoing attempt at addressing the issue, currently scoped for neovim[0]: https://github.com/legobeat/l7-devenv (I did share this to crickets as a Show HN the other day, hope it's on-topic enough to OK to reshare here) [0]: The same framework should, at least in theory, be extensible to do something similar with Code/VSCodium. While working on this I realized there is some overlap with their Dev Containers and am yet to look into if and

Read the rest

how one would run those in a similar fashion and if they could be leveraged to the same end

In Zed Editor automatically downloads binaries and NPM packages without consent

legobeet·Jul 4, 2024Submission

Show HN: Containerized security-focused terminal IDE - de aka l7-devenv

Hi HN, l7-devenv, or `de` for short[0], is a containerized terminal-based IDE using rootless Podman, neovim and friends, and proxying of network requests and sockets. IMO, the security story around most widely used code editors is not great today. Security, convenience, and productivity appear to be pick-any-2 when fundamentally I believe they don't have to be in conflict. `de` takes a critical look at the software and secrets used for day-to-day development and compartmentalizes them using containers. For example, you can connect seamlessly to authenticated GitHub endpoints without leaking your production token while LSPs and package scripts are run in separate ephemeral containers. It also provides features and integrations to make the developer experience more productive and joyful, with a current focus on Node.js development[1], GitH

Read the rest

ub, and web3. The main and integrated editor is neovim. No plugin manager is used; instead plugins are installed natively from git submodules and bundled into the image. This is currently in a prototype stage[2] and driven by internal needs. It derives heavily from existing community efforts (<3). You will find this relevant if you want: - To be using neovim for Node.js development and collaborating on github.com - Separate your developer credentials from your editor and code-under-test - More control of your https requests[3] - Something more secure than distrobox but more lightweight and seamless than QubesOS (<3) - More terminal joy and less waiting at requests to load for your routine code review workflows - Some inspiration for your own setup --- [0]: Names WIP [1]: While current focus is catering to JS/TS devs, it should be straightforward to add your own runtimes and buildtimes. There is an example for golang in there if you look around. [2]: Provided as-is, currently no guarantees given regarding actual security, etc. In particular, the proxied container socket used to spawn side-containers could definitely use some tightening down. [3]: The TLS MitM is already done and redirecting the current proxy to something like mitmproxy should be trivial for the motivated

4 points · Open discussion