Hacker News Reader

cv_hon Docker Sandboxes – Disposable, isolated sandboxes for AI agents

I wrote a CLI tool that uses QEMU's microvm machine type under the hood. It can take any docker image and build a microvm.

I use it regularly to run Claude/Codex with permission checks disabled.

https://github.com/cvhariharan/mvm

cv_hon Ask HN: What Are You Working On? (July 2026)

I’m already happy with the current set of features, and I don’t expect to add many new ones. I want Checkpost to be something you can host once and spend very little time managing.

One of my goals while building it was to use it for device posture checks. Currently, alerts can be integrated with VPNs and proxies to allow or deny requests from devices that fail certain checks, but this requires manually parsing the webhooks. Over the next couple of years, I plan to focus on making those integrations easier and more seamless.

Edit: One major feature I’d like to explore is device identity and attestation using TPMs or secure enclaves. This could allow Checkpost to verify that requests are only coming from enrolled devices.

cv_hon Ask HN: What Are You Working On? (July 2026)

I’m working on https://checkpost.dev, a lightweight and easy-to-use osquery manager. It is open source, easy to self-host, and ships as a single binary. It only requires osquery to be installed on the endpoints. Checkpost is readonly and doesn't make any changes on the enrolled hosts.

It can run adhoc or scheduled queries and send the results to ClickHouse, or store them locally in Parquet files and use DuckDB to browse the results. It can also initiate YARA scans and collect the results. It also supports policy evaluation and alerting.

cv_hon Cloudflare was down

Free accounts seem to be fine, only enterprise accounts seem to be affected.

cv_hon Show HN: Flowctl – Open-source self-service workflow automation platform

Hi! Sorry for the late response.

The key difference is the use case. n8n and Zapier are designed for integration automation for connecting apps and services together.

Flowctl focuses on operational workflows that require human approvals and inputs, things like database migrations, infrastructure changes or scheduled maintenance tasks.

n8n has some permissions features, but approvals aren't built-in. Zapier is cloud-only and expensive at scale. Flowctl is fully open-source with no enterprise only features.