toks

building @microsandbox (yc f26) | prev @cloudflare

imagine it, then build it till it's freaking good!

[toks @toksdotdev]

@Adidotdev i see the complete opposite.

literally every problem we've spent past 2-3 decades solving have re-emerged, but in different shape. e.g. security, identity, permissions, scaling, privacy, virtualization, code distribution, orchestration, etc.

it's the perfect time to build!

[microsandbox @microsandbox]

reminder: if your user can run docker, your user is root.

microsandbox has no daemon and runs rootless. nothing on your host is sitting there doing root favors.

you get a hardware-isolated microVM, full stop.

[microsandbox @microsandbox]

⚡ Microsandbox just leveled up (v0.5.x)

🔐 Native SSH & SFTP, no sshd needed
📂 New file commands (copy, mkdir, rm)
🛡️ Hardened mounts + env-backed secrets
💾 Configurable OCI upper sizes

Faster networking. Tighter security. Same blazing-fast sandboxes. 🚀

https://t.co/wL3DDk2Ao8

[toks @toksdotdev]

@TheDavidDias +1 to the agent skills.

ok, gonna need run these against our site to see what it suggest. 🔥

[toks @toksdotdev]

curious what else shipped? see https://t.co/5wfvjsUwiz

[toks @toksdotdev]

native SSH support now in [email protected]. 🍻

previously, you'd run sshd inside the sandbox and expose a port. well, no more. point your existing ssh/sftp clients straight at it.

available in all SDKs and CLI today. 🪅

[toks @toksdotdev]

@ondrejgmux @tereza_tizkova hehehe, @theappcypher you're being called upon. lol, he's got at least 2 or more awesome repos atm.

https://t.co/pOriPXXTUO

[toks @toksdotdev]

@TheDavidDias @DamiDina great meeting in person! cheers to more meets 🥂

[David Crawshaw @davidcrawshaw]

I understand the concern of skills atrophying when using agents. But so far I am not seeing it. Instead I have learned all sorts of dark secrets of linux networking I somehow didn’t learn before agents building a networking product.

[toks @toksdotdev]

weirdest part is that it began making reference to "night" several times in a session despite it being mid afternoon my time.

[toks @toksdotdev]

early usage of opus 4.8, and it tells me: "hey we've been at this for 12 hours. let me add the task to the plan, and call it a night. if i continue, i'll likely introduce bugs due to fatigue".

lol, not sure what to think of this. 😂

[toks @toksdotdev]

@1nterlandi couldn’t agree more 💯

[toks @toksdotdev]

https://t.co/0838zQq45D

[toks @toksdotdev]

we're slowly opening up our cloud beta. same SDK as local, just running on our infra. join the waitlist: https://t.co/JJRy45gyqA

[toks @toksdotdev]

your sandboxed agent calls OpenAI. its transcript, secret placeholders included, ships to S3 for archival. a prompt injection tries to exfil keys, or at minimum fingerprint which credentials exist. a release pipeline tries to send $NPM_TOKEN somewhere weird.

four scenarios, four different right answers. most sandbox providers stop at secret injection. that's 1 of 4. what about the other three? @microsandbox today gives you all 4.

i dig into all the details in this article.

[toks @toksdotdev]

https://t.co/0838zQq45D

[toks @toksdotdev]

@dreamsofcode_io @subnetmarco hahaha. true ... forgot about that.

the idea of being able to customise what was displayed was pretty great.

[toks @toksdotdev]

@dreamsofcode_io @subnetmarco not sure i agree. it was buggy as hell though. but concept wise, i think it was great imo.

[toks @toksdotdev]

@amianthus_ @autumnpricing employeemaxxing

[toks @toksdotdev]

@andruyeung 👋🏾

[toks @toksdotdev]

@benswerd yep! let's do that. 🤜🤛

[toks @toksdotdev]

fwiw, microsandbox supports bring your own kernel. definitely niche, but folks have asked for kernel features that didn't make sense to ship by default.

https://t.co/4463binbyf

we recommend basing your patches off our libkrunfw fork for full compatibility.

[Benۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗۗ☁️ @benswerd]

Considering offering a custom kernels API.

If we were to do it any ideas for interesting flags you'd flip?