Comment by salt-licker
4 days ago
Hey, I agree that trying to secure the harness with bubblewrap or other case-by-case limitations is inherently unsatisfactory, and I also wrote an open-source agent container tool (on top of gVisor + Kubernetes, since it can run pretty much anywhere at the cost of some performance). In case you're interested, I'd love your feedback, and obviously feel free to take any pieces that are helpful. The transparent egress proxy in particular was a pain to figure out: https://yaac.dev/
I looked and will give it a try, but haven’t had a chance yet because life.
I had debated building something like this, and I really want to see what the other fork in the path looks like.
One of the core tenants of mine is to not impose a workflow or set of tooling on the user. I specifically opted not to go with k8s because access to local files is going to be a pain, and I think people will still expect that. There’s all sorts of “I need this binary that’s not in APT”, or “you need this cert to test, and we can’t commit it” stumbling blocks.
Yours feels like it’s pushing me into an unfamiliar workflow, but opinionated tools are often better so it’s worth a try.
My only direct criticism is that I think k8s is a bad way to go for this (but is probably what people expect). For personal use, k8s is more than I want to deal with. For work use, I suspect lambdas would be cheaper and avoid a ton of maintenance junk. We tend to think of agents as a persistent process, but they’re sort of not. They’re a stateless process that is effectively dead until a new message comes in, let it be dead until something else comes down the pipe.
Yes — it is currently a downside that idle sessions are taking up resources. However, you can currently stop and restart them and it saves your active workspace, even untracked files in git. And there is active kubernetes work to make saving memory state to disk and restarting significantly easier, which would significantly reduce the resource burden: https://github.com/kubernetes/kubernetes/pull/140186
I was talking about how I was looking for something like this earlier.
1. I can feel the claudisms coming through, a turnoff for me personally
2. You're shaving yourself short on a good pun
I'll still give it a look since I am in the market for a kubernetes based platform for dealing with lots of agents across harnesses. Scion was my goto, but I'm not so keen on that project anymore.
My ideal solution does not require a running server (CRDs should be sufficient) nor a UI, I want to start new agents in my existing automations.
Hey, thanks! Probably the way I’d handle your use case would be to run the automations themselves inside yaac containers, which is admittedly a bit heavyweight, but on the plus side you always have an agent available to monitor or edit them if you want.
Also, which lines on the website are the claudiest? I tried to edit out the tone, especially too many one-two punches, but to be honest couldn’t be bothered to write every word myself still
It's not one thing in particular, it's woven throughout from the structure and phrasing to the design and color choices, there is this general vibe to claude produced artifacts. Part of the problem is that so many people are using claude, we just see this more and it's become tiring, so even a modest amount carries more impact than average.
If you want humans to spend time reading and evaluating, put the human time into writing and editing.
1 reply →