Regarding containerization, familiarize yourself with Dev Containers, they’re super useful for limiting agents to your codebase, with the added bonus that any project you work on comes out of the box with the right version of the tools you need.
Yeah I used to use dev containers. Containers aren’t generally a secure sandbox. They’re a great guardrail for preventing accidents, but not so much with a malicious prompt injection. (I might be overly paranoid about these things.)
For tool version management, I usually set up a Nix Flake for each project (which also works inside dev containers).
You’re right, they’re not watertight. But I’m not trying to defend against MPI, just hallucinations. Never looked into Nix flakes, I always just used OCIs.
Cheers, I’ll give this a try!
Regarding containerization, familiarize yourself with Dev Containers, they’re super useful for limiting agents to your codebase, with the added bonus that any project you work on comes out of the box with the right version of the tools you need.
Yeah I used to use dev containers. Containers aren’t generally a secure sandbox. They’re a great guardrail for preventing accidents, but not so much with a malicious prompt injection. (I might be overly paranoid about these things.)
For tool version management, I usually set up a Nix Flake for each project (which also works inside dev containers).
You’re right, they’re not watertight. But I’m not trying to defend against MPI, just hallucinations. Never looked into Nix flakes, I always just used OCIs.