5 ms·
> I don't want to give it "dangerous" access to my entire mac I'm running Claude/Codex inside native macOS sandbox, configured with a simple script - https://g
by sheremetyev 3mo ago
> I don't want to give it "dangerous" access to my entire mac
I'm running Claude/Codex inside native macOS sandbox, configured with a simple script - https://github.com/sheremetyev/sandfence https://github.com/sheremetyev/sandfence
always in "bypass permissions" mode - it works until task is solved, sometime 1 hour or more (which includes running tests etc)
- contingencies 3mo agorecommend converting to https://github.com/apple/container https://github.com/apple/container
- sheremetyev 3mo agoLinux VM doesn't run native macOS toolchain and requires copying files back and forth
- contingencies 3mo agoI am skeptical there are many real use cases that require native macOS not arbitrary unix. For files, use a readonly mount https://github.com/apple/container/blob/main/docs/how-to.md#share-host-files-with-your-container https://github.com/apple/container/blob/main/docs/how-to.md#... (ie. /path:ro)
- jpeeler 3mo agoIf you don't want to do that, don't use a VM. I like nono: https://github.com/always-further/nono https://github.com/always-further/nono