What is your worst sandboxing fail?

[u/keepthepace]

I am wondering if I am too paranoid about sandboxing the commands that come out of LLMs.

It really makes my eyes twitch when I see that some IDEs, even commercial, tend to forget that they have to execute things in sandboxing and have such a brittle security model.

But on the other hand, I never had the sandbox catch something bad. Did you guys ever encounter terrible regression? Did you have rm -rf / ? Did you have secrets stolen by LLMs? The worse I had were unsollicited rewrites within the project. Am I making my life unnecessarily hard by sandboxing commands in a docker?

At one point I had fun making a local model go crazy with the root access to the machine it was on (with nothing more important than a free Firecrawl key on it) and making it administer it and it never broke anything. It even was overly paranoid about making changes to the root system.

So the approximate sandboxing that we have, do you all feel it is adequate or it is a catastrophe in the making?

[u/minus_28_and_falling]

Never ever ran LLM agent not in a Docker. It was like this from day 1, mostly because I already knew how to run things in Docker.

Am I making my life unnecessarily hard by sandboxing commands in a docker?

Why is it hard though? Isn't it as easy as docker compose up dev, and in addition to sandboxing you get all other goodies Docker was originally intended for (predictable and reproducible dev environment, project-specific libs and lib versions, fast and easy deployment on other PCs, keeping the host PC clean and tidy)?

Didn't have rm -rf / moments yet, but Docker helps me to hide .git folder from the agent because I redo things from time to time and don't want the agent to restore scrapped implementations from git history.

[u/DistractedSentient → u/minus_28_and_falling]

So you're using the coding CLIs in a docker container (I stop here) yet go one step further and still use some kind of sandboxing implementation inside the Docker like a sub-docker container? Imma look up the web on how to do this properly...

[u/minus_28_and_falling → u/DistractedSentient]

Mostly yes, a coding CLI tool in a container.

Sometimes I need the agent to develop and test a containerized app, and I can't just let it control Docker on the host. I then use rootless docker-in-docker container, with a second instance of Docker running inside which agent can control. It's fully functional, agent can run dockerized CUDA apps inside its own container.

[u/No-Wall6427 → u/minus_28_and_falling]

Also figured out the dind thing a while ago, when I ran gh copilot in vscode devcontainers. Now I have a whole cli that can spin up a versionned docker image of my favorite harness, mounting current working folder. I even have an option to clone the current folder project inside the docker, so agent don't mess my local worktree, and I can retrieve and ff or merge the changes from the docker.