OK thanks! Would love to read :)
143 karma · joined March 26, 2012
It's still experimental and if you dive into the issues I would call its protection light. Many users experiences erratic issues with perms not being enforced, etc.
For me the largest limitation was that it's read-mode is deny-only, meaning that with an empty deny-list it can read all files on your laptop.
Restricting to specific domains have worked fine for me, but it can't block on specific ports, so you can't say for instance you may access these dev-server ports, but not dev-server ports belonging to another sandbox.
It feels as though the primary usecase is running inside an already network and filesystem sandboxed container.
It takes the stress about needing to monitor all the agents all the time too, which is great and creates incentives to learn how to build longer tasks for CC with more feedback loops.
I'm on Ubuntu 22.04 and it was surprisingly pleasant to create a layered sandbox approach with bubblewrap and Landlock LSM: Landlock for filesystem restrictions (deny-first, only whitelisted paths accessible) and TCP port control (API, git, local dev servers), bubblewrap for mount namespace isolation (/tmp per-project, hiding secrets), and dnsmasq for DNS whitelisting (only essential domains resolve - everything else gets NXDOMAIN).
I would normally tap out around the same place on the first dynamic programming puzzle which just takes me so long to wrap my head around each time (tips anyone? :)).
I welcome these new changes, and what ever the format are very greatful for all his hard work!
Starting out emacs i got super fatigued with all the long pinky driven commands for mostly used commands. It felt usable after I added keybindings for commands like switch buffer, close buffer, duplicate line(s), move line(s), find in project, find file in project, indent (wrote my own sane (for me)) indention code). The windows/apple key is great for those things because they are not used by emacs.
On linux I settled on using emacs vanilla key commands for copy/paste/cut but that took a looong time to feel comfortable with and I still mess it up sometimes, also with the ctrl+shift-X version of them in the terminal. On iOS, using the apple key like for the rest of the system is sweet relief.
Enterprise OAuth2 is a pain though - makes sending/receiving email complicated and setup takes forever [2].
from mcp.server.fastmcp import FastMCP
mcp = FastMCP("Basic Math Server")
@mcp.tool()
def multiply(a: int, b: int) -> int:
return a * b
mcp.run()
from foo import bar
bar"zoop"It feels like an upgrade from 3.5
Can it be integrated with an existing large nginx config with multiple domains, server and client certificates, websockets, other custom settings and different apps deployed with ansible or does it need to run the nginx process by itself?