← Back to context

Comment by kikimora

2 months ago

I did notice how Claude can start looking outside of working directory. It may scan home directory and find Homebrew token or SSH keys and wipe your GitHub repo.

9 comments

kikimora

Reply
ericd  2 months ago

Yes, it needs to be sandboxed very carefully. It should have no way to access anything outside of the directories you mount in the sandbox.

  • kikimora  2 months ago

    I wonder what is the approach you taking? In my dev env we have .env files that supposed to have dev api keys for staging and testing. Production parameters stored in parameter store. There is also deploy script, that can deploy into production given there is a token in AWS CLI.

    I understand there is a way to keep Claude inside working dir. but how to limit it from accidentally deploying production, modifying terraform deleting important resources? If dev can run AWS cli ir terraform then Claude can…

    • ericd  2 months ago

      I only run claude code inside a docker container that only mounts the directory it's called in, and I make damn sure I don't run it in a way to mount a directory that has any creds in it other than dev infra. Do not mount a home directory with a bunch of . directories (.aws, .ssh, etc). The nice thing about the docker containers otherwise is you need to explicitly choose what to pass in, but getting lazy and passing in things just in case or because it's convenient is asking for trouble.

compass_copium  2 months ago

I do not use claude and will use agents only when I am forced to, so I'm genuinely asking here:

Can claude or other models not be run as a user or program with limited permissions? Do people just not bother to set it up? Why on earth would anyone run an RNG that can access $HOME/.ssh?

  • mschulkind  2 months ago

    There's absolutely nothing special about any of these agents. They're regular processes that execute some subshells. They're trivially jailable.

  • matheusmoreira  2 months ago

    They absolutely can. I used to run Claude Code inside a firejail. Then I got paranoid to the point I developed my own virtual machine orchestration system just so I could run fully virtualized and isolated per-project Claude Code instances.

  • linkregister  2 months ago

    There are many useful tools for easily sandboxing agents. Visual Studio Code has devcontainers, which are trivially used.