95 lines
4.3 KiB
Markdown
95 lines
4.3 KiB
Markdown
---
|
|
title: "AI Sandbox"
|
|
description: "Federated CoreDesktop installs opencode, Hermes Agent, Cline Desktop and Claude Code, and runs them in a sandbox that keeps them out of your keys, passwords and other files."
|
|
sections:
|
|
- type: hero
|
|
compact: true
|
|
eyebrow: "opencode · Hermes Agent · Cline Desktop · Claude Code"
|
|
title: "AI agents that can't wander off."
|
|
subhead: "CoreDesktop installs four AI coding agents and runs them in a sandbox. They can change your project, and not much else."
|
|
ctas:
|
|
- label: "Sign in your agents"
|
|
url: "/utilities/#configure"
|
|
style: primary
|
|
- label: "Sandbox rules"
|
|
url: "https://gitea.federated.computer/Federated_Computer/coredesktop/src/branch/main/sandbox/config"
|
|
style: ghost
|
|
logTitle: "~/Projects/site $ opencode"
|
|
log:
|
|
- tag: "Sandbox"
|
|
text: "Write access: ~/Projects/site only"
|
|
- tag: "Read"
|
|
text: "Reading content/_index.md and hugo.toml"
|
|
- tag: "Write"
|
|
text: "Edited layouts/partials/header.html"
|
|
- think: true
|
|
tag: "Agent"
|
|
text: "Trying to read ~/.ssh/id_ed25519"
|
|
- tag: "Blocked"
|
|
text: "~/.ssh is hidden from the sandbox"
|
|
- tag: "Net"
|
|
text: "github.com, npm and PyPI: allowed"
|
|
- tag: "Blocked"
|
|
text: "pastebin.example: not on the allow list"
|
|
- done: true
|
|
text: "Done. 1 file changed, nothing else touched."
|
|
|
|
- type: split
|
|
kicker: "In the sandbox"
|
|
headline: "What an agent can and can't do."
|
|
columns:
|
|
- title: "It can"
|
|
items:
|
|
- "Change files only in the directory you start it from, plus its own settings and a few package caches. So start it from a project directory."
|
|
- "Reach AI providers and common developer sites: GitHub, Gitea, npm, PyPI, crates.io, RubyGems, the Go module proxy and archlinux.org."
|
|
- title: "It can't"
|
|
items:
|
|
- "Read your SSH keys, password stores or browser profiles"
|
|
- "Read Flatpak apps' data: browsers, Signal, Telegram and the rest"
|
|
- "Read your Nextcloud password, cloud and Git credentials"
|
|
- "Read the other agents' logins"
|
|
|
|
- type: cards
|
|
kicker: "The agents"
|
|
headline: "Four agents, one sandbox."
|
|
columns: 2
|
|
items:
|
|
- label: "opencode"
|
|
title: "Sandboxed when you type it"
|
|
body: "Typing `opencode` runs it in the sandbox. To run it without, type `unsandboxed opencode`."
|
|
- label: "Hermes Agent"
|
|
title: "Talk to it over Matrix"
|
|
body: "`hermes` or `hermes-agent` runs in the sandbox, and so does its gateway, which lets you talk to Hermes through Matrix and other messaging apps. Its sandbox allows local sockets but hides your D-Bus session, SSH agent, Docker, Tailscale, X11, tmux and browsers."
|
|
- label: "Cline Desktop"
|
|
title: "Your projects in ~/Projects"
|
|
body: "Opened from the app menu. It can change files in `~/Projects`, open projects elsewhere only to read them, and reach cline.bot. It draws through Wayland without the GPU, D-Bus or the keyring. `unsandboxed cline-desktop` runs it without the sandbox."
|
|
- label: "Claude Code"
|
|
title: "Its own built-in sandbox"
|
|
body: "Claude Code uses its own built-in sandbox for every command it runs. See `/sandbox` inside Claude."
|
|
|
|
- type: text
|
|
kicker: "Allow more"
|
|
headline: "When an agent needs a site or folder."
|
|
body: |
|
|
Add it in `~/.config/coredesktop/sandbox/base.json` for every agent, or in `~/.config/coredesktop/sandbox/opencode.json` (and so on) for one agent:
|
|
|
|
```
|
|
{
|
|
"network": { "allowedDomains": ["docs.example.com"] },
|
|
"filesystem": { "allowWrite": ["~/notes"] }
|
|
}
|
|
```
|
|
|
|
For Hermes' gateway to reach messaging services other than the Matrix server in its settings, add their domains the same way.
|
|
|
|
The sandbox is Anthropic's [sandbox runtime](https://github.com/anthropics/sandbox-runtime), which uses bubblewrap and socat. The default rules are in [sandbox/config/](https://gitea.federated.computer/Federated_Computer/coredesktop/src/branch/main/sandbox/config).
|
|
|
|
- type: final-cta
|
|
headline: "Sign in and pick a model provider."
|
|
body: "Before using an agent the first time, run `configure`."
|
|
ctas:
|
|
- label: "Configure your agents"
|
|
url: "/utilities/#configure"
|
|
style: primary
|
|
---
|