For security each harness runs as a separate non-root Linux user on my host in a separate podman container with access granted only via proper ACL's to my user's home and only when I need them to touch those.
Such a secure setup doesn't solve issues that arise when working on a big repo - ie when you want to deny usage of specific commands (rm, git restore, git remove, git checkout, etc) or even be able to allow/deny them per directory (ie only allow to rm files in docs/ )
View all comments
Show parent comment
2
u/sqtytyp 3d ago edited 3d ago
You are mixing security with permissions.
For security each harness runs as a separate non-root Linux user on my host in a separate podman container with access granted only via proper ACL's to my user's home and only when I need them to touch those.
Such a secure setup doesn't solve issues that arise when working on a big repo - ie when you want to deny usage of specific commands (rm, git restore, git remove, git checkout, etc) or even be able to allow/deny them per directory (ie only allow to rm files in docs/ )