Comment by darkwi11ow

1 day ago

I only use agentic development tools in qemu VM that has no production access or host shared folders, and the only secrets there are development. I still have my Git ssh key there, but I never use ssh agent to load the keys. The worst that agentic tools can do to me, is to install keylogger and compromise my ssh key and password, but even then my deployment workflow includes creating release in Github, which is not possible via ssh key only. I was very lucky to avoid the hack yesterday, as I use Claude installed via OpenVSX, but even if I installed the compromised version, the damage would be minimal.

5 comments

darkwi11ow

Reply
rietta  1 day ago

I am doing similar with Debian 13 images in QEMU. Only access is to code specifically SSH in. On some, I am taking it a step further and my SSH key is not present at all on the bot. I add it as a git remote from my host into the VM and push and pull from there and then push to GitHub myself. So the agent has no path to GitHub either.

  • darkwi11ow  1 day ago

    Wow, great notion about using git remote to transfer source from the agent host. I already use ssh into VM to transfer the files like designs for sharing, so going to adopt your approach right now :)

    • rietta  1 day ago

      Yup, I give them a custom entry in ~/.ssh/config like:

      ``` host claudebox hostname 192.168.122.105 user developer IdentityFile ~/.ssh/id_rsa ```

      ``` host codexbox hostname 192.168.122.106 user developer IdentityFile ~/.ssh/id_rsa ```

      I drop only my public key inside the VM. Then I set up the ~/Projects folder with the code the bot is working on any any authorized samples.

      Then in my local on my host clone of the repository, I add another remote like

      ``` git remote add codexbox ssh://codexbox/home/developer/Projects/hello-world ```

      Then git push codexbox.

      Then I just SSH in or use the vm gui and interact with the agent there. I like to keep it running in byobu so I can remote in more easily when I am on the laptop out and about.

      1 reply →

hangrybear666  1 day ago

Hell yeah that's the most sane and efficient personal dev sandboxing work flow I've heard and shows you know your stuff. Just basics but executed very well.