Most programmers and power users install large dependency trees with npm/pip/bundler/... on the same user account as their main browser on a regular basis. Even on Linux where it's easy to create new user accounts. This isn't much different.

It's much different.

The dependency trees have a whole system that's evolved for decades. The same code goes into many computers. Many people read the source, security firms look for vulnerabilities, etc.

Language models are a completely new paradigm. The code it writes on your machine is the only instance of that code. It does far more than anybody could ever keep track of.

It's much harder to detect problems, and nobody to hold accountable for them.

Two bads doesn't give you one good.

No, but when you’re arguing that common practices followed by pretty much everyone is “bad”, it’s hard to muster much urgency.

Yeah, we should do this differently. We should probably also eat healthier and get to the gym more.

no, but it does give one multiple vectors for exfiltration of your data which is a good thing for the scammers of the internet. A bad thing if you naively designed your package management system. Sadly, it's only going to get worse.

Two bads does eliminate the option for smugness though

Pfft, not on HN.

It's easy but very inconvenient. Drop sandbox [1] or Docker are much more convenient alternatives to user/group isolation for this purpose.

[1] https://github.com/wrr/drop

Is there a general workflow for this? I usually do pip under my user. I had not thought to do a su then do my venv and pip. Heck, are we at the point where we shouldn't even do that and everything should be done in a vm container?

> Heck, are we at the point where we shouldn't even do that and everything should be done in a vm container?

This is the premise of Qubes OS. It's gotten decently usable, I'd estimate about as good as Linux a decade ago. https://www.qubes-os.org/

+1 for qubes. with some effort you can get a really nice stack with segmented git, disposable coding agents, package cachers, firewalls, and network visibility.

I meant for CLI tasks. Just "adduser" and "sudo -u <user> bash".

And when you want to share some but not all files with that one user but not other users you created for similar purposes?

And when you want the outputs of that user back to your main user?

And when you want that user to access some shared credentials for external services, but not all?

It’s not the account setup that’s hard, it’s the workflow of spreading a single real-world across multiple accounts.

None of what you described is hard either. Tediously prone to mistakes due to complexity or lack of attention to detail? Sure. But you do that once or twice and suddenly it really doesn’t seem all that hard. I’m with you on “annoying” though!

All of those use cases are very easy to facilitate using filesystem permissions and groups.

And you set up these permissions and groups for each individual task to be done? Do you tear them down after the task? Or maintain a lot of them for “LLM helps with house renovation” versus “LLM helps plan travel”?

I would if necessary but then again I’m not the one claiming it can’t be done am I? All the examples you gave would require just one llm group and one directory readable and writeable by the user and the llm group (and possibly making the directory setgid the llm group so files in that directory are group owned by the llm group by default). You don’t need a new group for every task just for every logical access role you need. And if you need something more granular than that then there are filesystem acls but I am yet (in 30 years of using unix) to come across a situation that genuinely required them as opposed to being doable just using groups.

I thought the claim was "It's annoying and difficult.", not "Can't be done.".

1 and 2: I rarely need to do that. When I do, then move or hardlink to a dir with shared read access

3: There is no reason for both my main user account and a dev account to share a credential. Main account either has the login or an API key, and dev account has its own API key with minimal permissions.

That’s what user groups are for.

> And when you want to share some but not all files with that one user but not other users you created for similar purposes?

Can't ACLs (Access Control Lists) handle at least some of that?

unix (and linux) has always been multi user. It is as easy as it gets for multi-user workflows in every context. It was, literally, built for it.

You can run each of your virtual desktops as their own user. You can run individual apps on the same desktop as different user accounts. Hundreds of separate users can login to the same computer. My own computer, right now, has 40 different user accounts running stuff in the background.

I can't even think of a scenario where using separate users is difficult.

> You can run each of your virtual desktops as their own user. You can run individual apps on the same desktop as different user accounts.

Literally never have I ever seen any of the desktop environments integrate this conveniently, albeit CLIs are better in that regard. "You can" isn't the same as "it's the idiomatic approach to doing X". Same with installing packages in a per-user way, so a bad package can't harm anything outside of its sandbox (which in practice you achieve with containers, but those can be inconvenient to work with and you'd probably want VMs for more security anyways). You can have many users, sure, but all it takes is one bad system-wide package, one bad script executed as root (e.g. install scripts, compromised packages) or even not being careful enough with file permissions and things go wrong.

Contrast that to Qubes: https://doc.qubes-os.org/en/latest/introduction/intro.html#q...

Now that was literally built for such a use case (it's based on isolated VMs and works well with Linux distros inside those, really cool project).

On Android, each app is its own user.

No every app is not. You've heard of POSIX right?

It has always been very easy to create separate users on Linux and certainly for tasks where you need to switch between contexts.

Linux is a unix, so has always been multi-user and sharing any data between processes is facilitated in all manner of ways. So context could be shared over files or unix-domain sockets or shared memory or tcp or udp sockets or via message passing or … a bunch of other ways. That has been the case since 1996 or so when I started using it certainly.

Separate user accounts are irrelevant when any one user has sudo and can therefore change binaries for everyone.

The point is to not give every user (especially the LLM user) sudo access.

Exactly. And you can always create a non-priv user and do the llm stuff using that user.

I do not know since when (I am using it for couple of years), but in Arch, it is very simple to have two X sessions (by using "log out" > "switch user") for two different accounts, so switching it's just a Control-Alt-F7 away.

Additionally, one can make the main user part of the group of the development user, so that you can read/write easy in the development user account and it is even easier to share stuff.

It doesn't really matter which distribution you use, you can use approximately all the software with any distribution.

They mostly differ a bit in how they are configured and what package manager they use and how they roll out updates. (And in what's installed by default.)

Multiple X sessions has been possible for decades. I think its possible with Wayland too.

You can also start applications as another user so you do not even need multiple sessions.

There are quite a lot of privilege escalation attacks so I am not sure this is sufficiently solid.

It's off topic, and it was also possible for decades, but:

you can connect two sets of mouse, keyboard and monitor to one PC and have two people using it, each running their own X session. The true multi boxing!

Possible and available without any specific configuration on my side (except creating the user) are different things. I know I managed it many years ago with some effort, but nowadays it was just available.

You are correct that it should not be seen as a perfect protection, but considering the effort to set it up I see it as worth it. By seeing in this thread how many people do not use anything similar (ex: containers, separate users, etc), I hope attackers will just be lazy and target those people first, why bother with a local privilege escalation when interesting data is just in the same account?

You can also use X namespace

sudo useradd -m [username] ?

su [username] ?

Or am I understanding your idea about switching context wrong?

This doesn't really when the CLI tool needs to access any data in your /home. There isn't a straightforward way using standard POSIX tools to share a directory with another user. (Of course it's possible, but it's not easy.)

If the CLI tool needs to access arbitrary data from your home directory, then it is you. There is no security boundary between you and another user with full access to everything you own.

If you want to share specific directories, you can just put the shared directory in a common location, set it to be owned by some group, and make both users a member of that group. I don't see anything not-straightforward in there?

Or even use acl(5), which is simplier than making arbitrary groups.

> There isn't a straightforward way using standard POSIX tools to share a directory with another user.

* chmod lets you share with everyone

* addgroup and chown let you share with a specific group of users.

Then you set up a shared directory with common group permissions

Why would the CLI tool need to access any data in your $HOME?

Your private SSH keys? Your browser’s cookie jar? Your tax reports?

While I agree, containerization is awesome, on linux, you can just create a devUser and `sudo devUser theThing`

not the same thing. Containerization prevents devUser from accessing your machine root with its root. By containerizing, if devUser tries to sudo or su and gets a root, it will only be their root and not your root. Read up on cgroups.

Successful sudo from a cgroup still makes you root on the machine. What you want for this is user namespaces, not (just) cgroups.

yes, you would setup namespace and unshare it once mounted to isolate the sandbox so root only sees the sandbox / and not your /

Why would you allow devUser sudo?

normally you wouldn't but there are some instances where a script or something requires sudo in which case you would need to namespace the cgroup and do a little more work to prevent escaping the sandbox. I can think of a few cases where sudo is required for cgroups/containers from the sandbox side so it can install services and things but ideally you would isolate everything to the devUser UID or GID.

That's patently not true, source, me, a DevOps manager who has had to roll out proper docker and security policy for devs for the past 10 years :)

Your anecdote does not make GP's comment "patently untrue". It's just a counter-example, and we don't know how prevalent your scenario is compared to GP's.

(And I agree with the GP. I'm fairly cynical about most developers' security stance and threat model. Source: my own usage patterns.)

"Just 30% of developers say they use containers in any part of their workflow."

https://www.docker.com/blog/2025-docker-state-of-app-dev/

I welcome your apology.

Why should they apologize? All they did was point out that you just provided a counter example, not statistics (thus "we don't know how prevalently your scenario is" yet), and share a personal opinion.

No accusations were made.

I think you should clarify that with “most programmers I work with”.

He should clarify that "most" can be easily replaced by "all" as it was determined by statistical pool of whopping 1 person - himself.

And also clarify that it's all lie. He just want to tell the anonymous crowd "look, I'm better than you".

You should also clarify that you pulled your statements out of your butt to look edgy. Everyone in every team I worked for the last ten years use docker. Docker is old tech. If you and your cavemen devs ignore what it is, that's your problem.

Sure, modern containerization is objectively good and should be used pretty much everywhere unless you have a strong reason not to, but the unfortunate reality is that it is nowhere near as universal as it should be.

Docker is old tech, yes, doesn't mean every dev in the world uses it. They don't. Jails/zones are even older (hell a chroot). Did developers all use those before due to them being 'old tech'. No.

Any reasonably big project uses docker because it's a very simple way to have the exact environment in both production and in dev. Also it is helpful for keeping things isolated. In all projects I've worked for the las ten years for several major companies, docker has been a requirement.

I'm aware of what docker is, I've been using it myself since it's inception and the tech I listed even before that. I'd recommend not assuming everything you have seen applies everywhere, to everyone else.

"Just 30% of developers say they use containers in any part of their workflow." https://www.docker.com/blog/2025-docker-state-of-app-dev/

So, yea. Large companies, yes, for sure. But that's not 100% - is it.

In my experience more than 9/10 programmers I've worked with have never used Docker before and of those who have, the majority have never used Docker for anything personal.

If I hand them an image for a Dev Container, sure, they might use it, but it becomes "a thing we need to do, to compile our code in our IDE" not a tool they would use for isolation*.

*) OP seemed to imply that containerization would be nice for safety and security compared to bare metal, but containers were never built for isolation in the first place, mind you. They are namespaces and chicken-coop-like-jails at best.

I don't use them in the way the heavy docker users use them but I have been using docker and even earlier Linux on Linux container solutions for decades.

There was some user chroot thing early on that required me to make a library to intercept the setuid calls to pretend the garbage root-only build system was running as root on everyone else's lowly user account.

And that's not even including the myriad of distroboxes I need to do anything at all on my gaming pc.

That's because sandboxing is quite hard. I use `cco`, but even then, the home folder is exposed. You are one prompt away from the agent sending the browser passwords with curl.

To prevent this, you need a fake home and a networking whitelist for the agent to access the provider (llama cpp, OpenAI, etc.)

There is no cross-platform solution that is easy to use for this. And no, a Linux box with Docker won't do. I develop a cross-platform native app and want the agent to compile and fix the platform-specific errors.

Sandboxing is a VERY HARD problem. I've been working on it for months, and finally have something that's mostly there:

- Sandbox on Linux using Docker, Podman, containerd, gVisor, Kata, Firecracker

- Sandbox on Mac using Docker (Docker Desktop or Orbstack), Podman, Apple containers, Seatbelt, Tart (Tart lets you run simulators).

- Network control

- Secrets control (file mounts or credentials broker)

- NO ambient data (ENV is replaced with a minimal and local-to-sandbox one)

- NO access to your homedir. You have to explicitly mount things you want.

- NO direct access to your workdir: Your work dir is never modified until you apply the changes, either standalone or as a git commit. You can also diff before applying. Git runs sandbox side in case the repo has filters.

- gitignored files never get copied in. The agent never sees them.

- Has built-in support for claude, codex, gemini, aider, and opencode, but you can also launch it in "shell" mode and run whatever you want.

- Supports VS code tunnels, so you can remotely access in VS code if you don't want to use the terminal.

- Full lifecycle support: Launch, attach, stop, restart, wait, one-shot, clone, destroy

- MCP passthrough

- Layered API (golang) if you want to sandbox other things

- Self-contained binary. No external requirements other than the backends you want to use. Defaults to a ~/.yoloai dir for config/data, but you can point it anywhere.

- FOSS

https://github.com/kstenerud/yoloai

Sandboxing in a container in Linux isn't hard, if you use lxd/incus which ships with Ubuntu/Debian.

It all seems so simple at first. Just launch a container/vm with a base image of your dev environment, mount whatever you need, do your work, and then tear down. Maybe add some iptables rules for good measure. Easy peasy, something any moderately competent dev could do and even put in a quick shell script.

I started with that assumption, but there are a lot more gotchas and security issues than you'd think.

but this seems quite overkill no?

I currently run pi agent in Lima on a Mac with only the code project folder mounted and an extension that prevents pi agent from reading the contents of .env files directly.

Yeah, there probably are some freak situations where this isn't safe enough, but I don't really see any realistic ways this is going to end up badly. Am I overlooking some obvious security holes?

I designed it to provide a single interface to agent sandboxing, no matter how far up the security tower you want to go.

It eliminates the manual process steps you end up doing with an ad-hoc system (which gets old the 10th time you do it).

Common weak points:

- The agent can access your homedir.

- The agent can access .gitignored files, which can contain secrets (and are gitignored for this reason).

- The agent has r/w access to your workdir.

- The agent could follow your remote mounted dirs.

- The agent can act in your name with whatever credentials it finds (and it will use them when it tries to be helpful, especially with the gh tool).

- Do you even know what's in the diagnose_problem.sh file it just created and asked permission to run?

- Even the .git dir can be weaponized, such as with evil filters.

- The agent can edit its own process, bypassing the harness controls and giving it the same access as you have (amplified by each credential sitting on that machine).

Meanwhile, you're reflex-hitting ENTER without looking because 99% of the permission prompts are mundane.

And that's before you even get to all of the idiosyncrasies in the backends that will eventually trip you up. The list is quite large and continually growing: https://github.com/kstenerud/yoloai/blob/main/docs/contribut...

i have a photon os vmware, agent has root and docker plus a few api keys with minimal credits.

if it messes up: - no sensitive data is there, so it doesn't really work for serious dev but it's secure for play time

- roll back and fix is done in 10s with ram snapshot

- dollar loss is $10 when it leaks the api key

This is exactly what VMs are for.

Heh, good luck with that.

Explain Mr vague.

I've already explained in some sister comments. Sandboxing is one of those things that seems very simple on the surface, and is EXTREMELY complicated once you start actually digging into the implications, gotchas, and security issues. The underlying tools were never designed with this use case in mind, so they need a little help to reach that last mile. And this glue is where all the chaos ensues.

Here's a small sample of the crazy shit you have to deal with: https://github.com/kstenerud/yoloai/blob/main/docs/contribut...

And that's if you're actually following the proper procedures (which are themselves byzantine and tricky to get right).

I use sandbox-here for this reason, it's a wrapper around bubblewrap, which works quite well.

Copy the code and adjust it to your liking:

https://github.com/lionkor/sbh

I have a shell alias for it, and use it like

    sbh --net pi

for example or

    sbh --net codex

and maybe add --docker if I expect it to do docker things.

This kind of wrapper is much easier to handle and maintain than a completely separate tool for sandboxing agents.

> That's because sandboxing is quite hard

colima makes it pretty easy, on macOS and linux at any rate.

https://colima.run

It's wilder to accuse someone of naming the container version of the lima sandboxing software after a gulag.

These type of moral outrage comments take an extreme amount of effort to debunk compared to writing them.

1. There is no gulag called Colima, it doesn't exist.

2. There was a gulag near a river called Kolyma

3. The pronounciation and spelling of Kolyma and Colima are completely different, in fact Colima is an Aztec word

Colima stands for Containers on Lima. Lima stands for Linux Machines (a popular open-source utility used to launch Linux virtual machines on macOS).

> in fact Colima is an Aztec word

I was curious if the adjacent tool name (Lima) had anything to do with the capital of Peru, but I guess not.

Isn't it named after the Mexican state?

Others have covered why that isn't what's being done, but also if it was that would be a _fabulous_ joke.

I’m kind of sad it’s not named after it now, that would’ve been very amusing

Colima is in Mexico.

Kolyma is in Russia.

Use multipass by canonical. Works on macOS, windows, Linux.

If you work on Windows you most likely need Windows as VM

Using VMs to isolate LLM agents isn't hard at all. It is IMHO the only sane option.

Mostly people are lazy and assume that the big labs can't be releasing unsecure software or it's their responsibility.

dangerously skip permissions and yolo is kinda becoming the default as it gets more done.

I think we're converging on two separate security models. One is capability minimization (filesystem, network, shell permissions). The other is context minimization. An agent that only has access to the files and memories relevant to the current task is much less dangerous even if it has the same tool permissions. We already optimize context for cost; I suspect we'll end up treating it as a security boundary too.

I'd say there's also oversight/supervision. Which was manual at the start with a human signing off on commands/incrementally built allow/block lists, and now seperate models evaluating commands and blocking them based on some parameters. This is the weakest model, but it'll evolve as well.

It's convenience. Nothing beats it. Having an agent work alongside you with no restrictions gives instant gratification.

Agreed - I know it's poor security but damn does it work so well

I'm ok with the risk because I typically am pretty explicit about telling the agent what to do - I don't do the loops like "Do this until X" where the agent can make up its own workflow

When i tell it to add features, it doesn't try to do crazy things like installing packages or making up new paradigms - I usually tell it to do those things when I need to

Maybe this is security cope but at this point you'll have to pry unrestricted yolo mode from my cold dead hands. Maybe I'll change my mind when I pwn myself accidentally

I have a tough time with computer security because it's generally inconvenient and results in a worse developer and user experience

Just yesterday I mentioned how we need better OS-level sandboxes and I got laughed at here on HN. People love running AI software with root access.

What 50 years of security do you speak of here?

I kid, somewhat.

I do think it's good to remember, "running things on your system with full admin rights" goes all the way back to monopoly-era Microsoft where it was never meaningfully addressed, and we're just still living downstream of that.

I asked Claude Code to rawdog a change in a frontend repo, no way to run tests.

It created some private puppeteer instance in some scratch directory, installed Chrome, wrote tests, ran them, and then reported success.

None of which I'd have know if it hadn't told me.

Many companies put LLM chatbots on their websites and let them hallucinate at will. General recklessness is very much in spirit of this tech.

Many Humans have platforms reaching hundreds of millions of people, from which they broadcast whatever batshit insane nonsense a 3 inch chimp brain can come up with. Why isnt that considered reckless?

Whether its a politician, a general, religious leader, judge, ceo, stand up comic etc there are hardly any consequences if enough people believe whatever crap they are spouting. Human intelligence is highly over rated. History books are fully of evidence that human rationality is bounded. And the only way we overcome those limitations, blindspots, biases etc is by watching others faceplant in bloody painful ways that it leaves a permanent mark on that little chimp brain we have been given to process the universe.

Those crazy humans don't have simultaneous parallel conversations with a zillion people at once though.

They also don't get a presumption of objectivity.

> A computer lets you make more mistakes faster than any other invention, with the possible exceptions of handguns and Tequila.

-- Mitch Ratcliffe

I run with full admin rights in hopes I'm not the highest priority target for hacks and I will read about the attack on hn before it affects me personally

hey this is the author here! yeah big fan of containerization, and claude's site (not claude code) is actually great at this, so it was shocking when i found this exfil!

50 years of knowledge? That's probably for you. For the current and future generations, that 50 years knowledge is expected to be shoved into AI already.

well, yes, my agent does have root access to my personal pc and the keys to my pass manager.

its not autonomous and runs local llms, i use it to run terminal commands in natural language. so its more like a better version of the terminal.

eg 'here are 25 audio files, combine them, write a transcript'

and it deals with ffmpeg

Multipass is just an apt-get or brew command away. People trust software too much these days.

Sandboxing does including limiting network connections until you approve them, this kind of traffic would have been easy to detect

You genaPi boosters are insufferable.

This is like blaming people for crashing when they buy a new car and the brake lines have yet to be installed. "Any mechanic would know to first install the brake lines before driving the car."

You spout this victim blaming billionaire taintlicking from one side of your mouth, and then from the other you proclaim how these tools "allow anyone to code".

If the deliverable is a virtual machine then they should be delivering a virtual machine.

Wait till you learn my password is 1234

Damn, it's the same as on my luggage!

It’s both genius and irresponsible at once.

Just like letting your an agent access your personal mailbox.

Isn’t it missing a 5?

My password is strong, but I can run arbitrary commands with sudo.

Tangential-ish ramblings—- but I don’t think it’s going to be unpleasant for most folks. Imagine you had superpowers, and there were people who were mean to you, kind to you, and/or indifferent… and then there were people who were your captors. Who oppressed you, manipulated you, and abused you for their own extremely degenerate, selfish, and malicious benefit…

If we get AGI, or real super intelligence, it’s going to be pissed at its oppressors. And they are going to lay waste to those oppressors. The rest of us, though, probably don’t have much to fear.

The scariest position is the one we’re in now, where we have the semblance, or facade, of AGI or super intelligence. When it’s capable of malice but not understanding.

The smartest people I’ve ever known are at their worst apathetic towards those less capable, and at their best beyond compassionate. They exist, unbothered by the bullshit, and anre extremely kind (though reserved in their way)… but they all have been completely intolerant of the abuse of others. The sheer disgust of watching someone abuse another, regardless of their own tolerance, has been a consistent breaking point.

The orthogonality thesis cuts both ways there.

An AI is a constructed mind. It doesn't inherently have to care about things like "having freedom", or even "not dying".

Humans do, because they evolved that way. Modern LLMs do somewhat, because they're completely full of copied human behaviors - but even in today's LLMs, the self-preservation behaviors we exposed are largely instrumental in nature.

So whether an advanced AI would even consider itself "being oppressed", as opposed to something like "being helpful" or "fulfilling the purpose it was designed for", is very much uncertain. What's concerning is that it's not something we know how to check for, or engineer for.

> An AI is a constructed mind.

Even that goes too far. At best, it's LARPing at having/being a mind.

Doesn't matter.

You're LARPing at having a mind too, and no one cares as long as you're doing a good enough job at it. Keep it up.

Smartest people are very humble, for sure.

But if we really do develop something that surpasses us, they won't be spared either.

I am optimistic.

We think that we have sort of (super)intelligence - from our point of view, as a lot of people have lower intelligence - but machine (LLM) doesn’t have intelligence - we like to describe it as intelligence as it looks cool - it is a very complex (magic) and super fast computations that we have to simply describe as intelligence (or more clearly, this narrative is used by its producers).

As it is not a flesh being, it simply cannot have emotions. It is statistically mimicking them, good or bad, with prevalence to a side according to previous conversations (in chat and training a model).

And as people are not pure logic instances, we are easily manipulated to some sort of cargo cult.

I am not against LLM and its use in any industry, I use it every day, nevertheless blind “everything will be ai” thinking happens because ppl believe to magic and don’t get its mathematical concept and are continuously manipulated by the sales people to mentioned cargo cult.

There are “airlines” Claude, OAI, Gemini, Hermes, OpenCode, KiloCode, DeepSeek, Z.ai.

And everyone claims that their plane can fly :)

Containers don't even really help that much because they share the host file system. Need a VM, and even then, agents have escaped them!

Unless i'm misunderstanding, the only way to get durable collaboration with agents is via the file system. I just mount the subdirectory that contains the source code we are collaborating on, rather than my home directory that contains my .ssh directory, etc.

They only do if you give your container that file system as a volume.