ducoterra
03ab9c0cb1
A single bash script that runs a coding harness (pi by default) inside a rootless Ubuntu 24.04 container with only the current directory mounted at /project, an explicit egress allowlist and an explicit environment: nothing is passed in that was not named on the command line or in a config file. Network enforcement here is empirical rather than assumed (tests/spike_network.sh, docs/networking.md). The original design -- a sidecar proxy on an internal network -- does not work rootless on this host, so allow mode runs pasta with --map-host-loopback, installs an inet aisb ruleset inside the container that drops every egress path except the gate's, and relays through a squid gate bound to the host's loopback that resolves names itself and refuses anything unlisted. The entrypoint checks that the default-drop rule really exists before setpriv drops to uid 1000 with an empty capability set, and exits 77/78 rather than run unenforced. The Containerfile, the entrypoint, the squid config generator and the ruleset renderer all live in bin/ai-sandbox, and the image is tagged by content hash, so a policy change can never silently reuse a stale image. Tests are pure bash: 161 assertions start no container and touch no network, 256 run real ones, including proof that a raw socket, a stripped proxy env and DNS all stay blocked while an allowlisted host works over both http and CONNECT. LLM-Generated: true
12 lines
430 B
Plaintext
12 lines
430 B
Plaintext
# Copy to a file only you can read, then: ai-sandbox --env-file ~/.config/ai-sandbox/env
|
|
#
|
|
# chmod 600 ~/.config/ai-sandbox/env
|
|
#
|
|
# One NAME=VALUE per line. '#' comments and blank lines are ignored.
|
|
# Nothing here is passed to the container unless you ask for it with --env or
|
|
# --env-file, so listing a variable is not the same as granting it.
|
|
#
|
|
# ANTHROPIC_API_KEY=sk-ant-...
|
|
# OPENAI_API_KEY=sk-...
|
|
# ANTHROPIC_MODEL=sonnet
|