It's an NVidia product, and so far I quite like their sandboxing and policy system. I'm still getting used to the download and upload flow though, it makes it a bit more annoying to read diffs and commit (unless you let it git as a part of the policy)
An ec2 or vps. But no sandbox can solve the problem that a true powerful harness would need access to the source of your information like slack and jira.
I recommend just setting up a podman container, LLM can do it for you.
Basically Podman is a more secure version of Docker.
I would keep stuff like secret keys outside the container and sign/push commits manually.
It's still a bit young, but I've been playing around with OpenShell at home. https://github.com/NVIDIA/OpenShell
It's an NVidia product, and so far I quite like their sandboxing and policy system. I'm still getting used to the download and upload flow though, it makes it a bit more annoying to read diffs and commit (unless you let it git as a part of the policy)
https://github.com/marius/devmicrosandbox
An ec2 or vps. But no sandbox can solve the problem that a true powerful harness would need access to the source of your information like slack and jira.
I use bubblewrap, but it doesn't play all too well with client server.
apparmor in enforce mode with very strict config
[flagged]
[dead]