Post #3970469
2026-07-20 21:22 UTC
@ramsey@phpc.social pro tip: if you have /path/repos/reponame on the host, run claude inside a docker and mount /path/repos ro, /path/repos/reponame rw and /path/repos/reponame/.git ro. Now it can mess with the working copy and not fuck up the git history. It will try to do things it shouldn't but it won't be able to. Worst case is that it can lose the working copy. It won't be able to commit, but it won't set fire to the work history either.
I am continually astounded that this tech can be simultaneously so terrible and useful at the same time.
Replies (2)
-
@GuillaumeRossolini@infosec.exchange 2026-07-20 21:41
@wez@social.treehouse.systems I read about someone asking their bot how it managed to write in a system directory supposedly out of its sandbox and the bot essentially responded, well, I ran a docker image with a mounted volume and that gave me write access wherever I wanted Because indeed, docker doesn’t have the same permissions as the bot @ramsey@phpc.social
-
@ramsey@phpc.social 2026-07-20 21:41
@wez@social.treehouse.systems It’s just advanced auto-complete.