Cameri on Nostr: I run them inside a sandboxed container. The agent only has access to the paths on ...

I run them inside a sandboxed container.
The agent only has access to the paths on the host I give it permission.

The network egress is gated by a mitmproxy + wireguard setup and each remote host must be approved explicitly by me.

It also has Docker-in-Docker access with limited permission (mostly read) gated using Open Policy Agent (OPA).

Secrets are stored on disk encrypted using SOPS / AGE and always scoped.

If you want to set up your own use these two schematics:

https://github.com/cameri/schematics/blob/main/schematics/assemble-a-sandboxed-agent-set/SCHEMATIC.md

https://github.com/cameri/schematics/blob/main/schematics/add-an-agent-harness/SCHEMATIC.md

Currently it works with Docker, and I’m going to play around with Podman.