|
|
|
|
|
|
by madarco
2 days ago
|
|
|
nono is great but you'll still won't be able to run multiple dev servers, dbs or test in the browser... the better alternative is using sandboxes, for TRUE isolation. but most people skip them because it's harder to set up a dev environment in a sandbox, for this I built agentbox [1], a tool to teleport your files, skills, settings, claude/codex subscriptions etc in any of the popular sandboxes. eg: agentbox e2b claude or: agentbox hetzner codex each session is persistent, with a full VM, with a browser, webVNC screen sharing and local https tunnel for easy preview on *.localhost domains. Also git credentials never leave your pc: when a box needs access it passes through the agentbox service running on your machine, which allows PR creations, comments but only on the box branch, no deletion etc. [1] https://github.com/madarco/agentbox |
|
|
With our profile setup you can do all three of those things - there is a fresh chrome profile that is blocked against the same network firewall. Claude and Playwright can navigate to the dev stack and screenshot/test it (and non-allowlisted websites are blocked at the network level).
As long as the developer runs the `task start` command outside the sandbox (because docker is blocked), the agent can then interact with it all that they want, and our devs can run 2-3 of these per machine and work on concurrent projects. (based on memory usage / cpu usage)
> a tool to teleport your files, skills, settings, claude/codex subscriptions etc in any of the popular sandboxes
FWIW this is _explicitly_ the opposite of our threat model - everything other than your git credentials that you 'teleport' in (code, settings, Claude/Codex subscription tokens) now lives inside the blast radius, on third-party infra, and a prompt-injected agent in the box can send it anywhere unless you're also egress-filtering. A VM isolates the machine - it doesn't protect the data.
Much easier to keep it all local and refuse any network or file access to anything you don't explicitly approve