6 ms·

If you are a Nix flake enjoyer, I whipped up something similar to this (Claude Code-only right now) based on microvm.nix: https://github.com/cdata/katsuobushi/t

by cdata 2mo ago

If you are a Nix flake enjoyer, I whipped up something similar to this (Claude Code-only right now) based on microvm.nix: https://github.com/cdata/katsuobushi/tree/main/lib/sandbox https://github.com/cdata/katsuobushi/tree/main/lib/sandbox Some highlights: - Drives Claude Code as a quasi-subagent via "Channels," which supports multi-turn interaction with the host and suspend / resume - Declarative configuration in the flake of exactly what is copied into the VM (besides the local project), what DNS origins are allowed, etc. - Shared access to host Nix store / object DB via overlay FS - Syncs code with the host over a shared (local) Git remote (no worktree mess to manage) - Devshell commands for quickly dropping into the guest and viewing status of all VMs etc. - VMs start in a couple of seconds

mkagenius 2mo ago
If you are into nixos, we at InstaVM have just launched[1] nixos based sandboxes. 1. https://instavm.io/blog/nixos-reproducible-dev-environments-on-instavm https://instavm.io/blog/nixos-reproducible-dev-environments-...
- cdata 2mo ago
  That's very cool, although AFAICT my hacked-together non-product shares most of the same virtues. Can you upsell it to me a little?
  - mkagenius 2mo ago
    Our nixos sandboxes are mostly a cloud offering at this time. Scale is what we can offer additionally. Have secret injection built in too. I see you have suspend, resume we have the same. We have snapshots and cloning. Startup time is sub second with warm pools - which will go further down when we replace firecracker with Tarit soon. 1. Tarit - https://GitHub.com/instavm/tarit https://GitHub.com/instavm/tarit
riedel 2mo ago
Nice I started to vibecode something with bwrap.nix: https://github.com/riedel/nix-opencode-with-mitm https://github.com/riedel/nix-opencode-with-mitm (not anywhere near production ready) What I would really want is token injection outside the sandbox and good control over the network, why I tried integrating a mitm proxy outside the sandbox.

by cdata 2mo ago

mkagenius 2mo ago

If you are into nixos, we at InstaVM have just launched[1] nixos based sandboxes. 1. https://instavm.io/blog/nixos-reproducible-dev-environments-on-instavm https://instavm.io/blog/nixos-reproducible-dev-environments-...

cdata 2mo ago
That's very cool, although AFAICT my hacked-together non-product shares most of the same virtues. Can you upsell it to me a little?
- mkagenius 2mo ago
  Our nixos sandboxes are mostly a cloud offering at this time. Scale is what we can offer additionally. Have secret injection built in too. I see you have suspend, resume we have the same. We have snapshots and cloning. Startup time is sub second with warm pools - which will go further down when we replace firecracker with Tarit soon. 1. Tarit - https://GitHub.com/instavm/tarit https://GitHub.com/instavm/tarit

riedel 2mo ago

Nice I started to vibecode something with bwrap.nix: https://github.com/riedel/nix-opencode-with-mitm https://github.com/riedel/nix-opencode-with-mitm (not anywhere near production ready) What I would really want is token injection outside the sandbox and good control over the network, why I tried integrating a mitm proxy outside the sandbox.