Thread

1. gregwebs · 1790096079 · focus · HN ↗

   Glad to see this coming with gVisor support to help secure the Kernel- IMHO we should expect frontier models to find Kernel exploits.

   I am working on a project similar in spirit that uses microsandbox (libkrun) to run inside a tiny and fast VM. It includes other security properties that are needed for some workloads.

     * network allow lists
     * credential masking
     * github allow list
   

   <a href="https:&#x2F;&#x2F;github.com&#x2F;gregwebs&#x2F;agent-vm&#x2F;#agent-vm" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;gregwebs&#x2F;agent-vm&#x2F;#agent-vm

   1. NewJazz · 1790096480 · focus · HN ↗

      Couldn&#x27;t you use fine grained github tokens for some of what you&#x27;re accomplishing with the github&#x2F;network filtering?

      1. asb · 1790097151 · focus · HN ↗

         The fine-grained tokens have some surprising permissions for &quot;read only&quot; <a href="https:&#x2F;&#x2F;github.com&#x2F;orgs&#x2F;community&#x2F;discussions&#x2F;180063" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;orgs&#x2F;community&#x2F;discussions&#x2F;180063

Unofficial Hacker News client; not affiliated with Y Combinator.