Comment on Slightly safer vibecoding by adopting old hacker habitsparentComments−kstenerud5moIt actually runs git (with hooks disabled) to generate the diff. It happens on the host when using copy mode, and inside the sandbox when using overlay mode.The above example doesn't specify workdir mounting mode, so it would be copy, not overlay.−creata5moIf it runs inside the sandbox and the guest is compromised, can't the guest just lie?−kstenerud5moAbsolutely. That's why overlay is not the default.−creata5moThat's... uh, an interesting approach to security.−kstenerud5moWhat is? Defaulting to the most secure method?
Comments
It actually runs git (with hooks disabled) to generate the diff. It happens on the host when using copy mode, and inside the sandbox when using overlay mode.
The above example doesn't specify workdir mounting mode, so it would be copy, not overlay.
If it runs inside the sandbox and the guest is compromised, can't the guest just lie?
Absolutely. That's why overlay is not the default.
That's... uh, an interesting approach to security.
What is? Defaulting to the most secure method?