This is the only way. Auto mode is really just yolo mode with more LLM tokens billed. It may catch some weird shit but it isn't a reliable sandbox. Just lock up the LLM and let it run.
Are you sure? When they announced it they said they will update quotas to account for it. Which just means that the next adjustment will effectively null it out.
The docs all say there is a time and billing cost:
It's the only way if you want 100% security but often a compromise between security and usability is preferred.
I'm actually working on multi harness auto mode. It's already done for Pi and I'm currently working on copilot cli port (where it is needed the most by the fa r of autopilot in copilot being so atrocious).
The correct way for auto approve to work is similar to what claude code does (a deterministic algorithm where a separate model reads what the user says and adds rules based on what the user enables).
I couldn't believe such a thing that works well doesn't exist, but it doesn't. You either have to do borderline yolo or you cannot leave a model working overnight and not find it got stuck on some silyness after an hour.
It's an NVidia product, and so far I quite like their sandboxing and policy system. I'm still getting used to the download and upload flow though, it makes it a bit more annoying to read diffs and commit (unless you let it git as a part of the policy)
An ec2 or vps. But no sandbox can solve the problem that a true powerful harness would need access to the source of your information like slack and jira.
This is the only way. Auto mode is really just yolo mode with more LLM tokens billed. It may catch some weird shit but it isn't a reliable sandbox. Just lock up the LLM and let it run.
Just FYI, auto mode is free now.
Are you sure? When they announced it they said they will update quotas to account for it. Which just means that the next adjustment will effectively null it out.
The docs all say there is a time and billing cost:
> Auto mode may have a small impact on token consumption, cost, and latency for tool calls. https://claude.com/resources/articles/auto-mode#what-to-expe...
https://code.claude.com/docs/en/permission-modes#cost-and-la... doesn't say anything specific. It mentions that server-side classification can be used but doesn't talk about the billing for it.
But at the end of the day it is a leaky system. It may reduce the frequency of bad actions but doesn't prevent it. So you need the sandbox either way.
1 reply →
It's the only way if you want 100% security but often a compromise between security and usability is preferred.
I'm actually working on multi harness auto mode. It's already done for Pi and I'm currently working on copilot cli port (where it is needed the most by the fa r of autopilot in copilot being so atrocious).
The correct way for auto approve to work is similar to what claude code does (a deterministic algorithm where a separate model reads what the user says and adds rules based on what the user enables).
I couldn't believe such a thing that works well doesn't exist, but it doesn't. You either have to do borderline yolo or you cannot leave a model working overnight and not find it got stuck on some silyness after an hour.
What sandboxing tools do you recommend? There's lots out there and I'm unsure which to trust.
I recommend just setting up a podman container, LLM can do it for you.
Basically Podman is a more secure version of Docker.
I would keep stuff like secret keys outside the container and sign/push commits manually.
It's still a bit young, but I've been playing around with OpenShell at home. https://github.com/NVIDIA/OpenShell
It's an NVidia product, and so far I quite like their sandboxing and policy system. I'm still getting used to the download and upload flow though, it makes it a bit more annoying to read diffs and commit (unless you let it git as a part of the policy)
https://github.com/marius/devmicrosandbox
An ec2 or vps. But no sandbox can solve the problem that a true powerful harness would need access to the source of your information like slack and jira.
I use bubblewrap, but it doesn't play all too well with client server.
apparmor in enforce mode with very strict config
[flagged]
[dead]