My Paranoid Coding Machine Setup

To protect against potential supply chain attacks and accidental damage from autonomous AI agents, the author implemented a heavily sandboxed environment using an unprivileged virtual machine, rootless Podman, gVisor, and restricted network policies. The setup isolates the agent harness while maintaining necessary capabilities like Docker testing and GPU access. Additionally, a local Text-to-Speech service was rewritten in Rust and sandboxed to avoid exposing vulnerable C code to the internet. Open article →