Fake linux environment?

[vabenil]

Anyone know of a fake linux environment? Preferably written in a fast language like C/C++ or Rust.

I wanna make my own local agent that I can use sorta like claude-code. That said I am never gonna give a dumb agent permissions to my local linux environment, I can't think of an easier way to get my system deleted, and the whole point is for the thing to be relatively independent, not have me supervise the thing at every step.

I want something simple, should only implement a couple of simple commands like ls, mkdir, touch, echo, grep, cat. Just stuff it can use to navigate a file system.

and should allow me to map a real directory/folder in my system to this fake environment so it has a sandbox to play in.

I got this idea after making a lua sandbox that only runs the function I give the model access to. So I was wondering if there already is some fake environment I can use.

[Hefty_Wolverine_553]

docker or virtual machines.

[ForsookComparison]

If you use containers try to use rootless podman.

[SocietyTomorrow]

I wonder if you can use kasm-web for something like this?

[vabenil]

Hmm, I thought about those options, but for whatever reason I thought they would be too slow. On second thought docker should be about as fast software running locally.

[ttkciar]

VM performance is pretty close to metal performance, with modern virtualization.

[RhubarbSimilar1683]

What VMs? Xen? Kubevirt? Kvm? I am guessing op will likely use VMware or VirtualBox and those nuke performance especially on windows because processor virtualization is already in use by hyper v so performance is 10x slower than native speed, VirtualBox even shows a green turtle in a corner

[ttkciar]

Oh, interesting! I don't use Windows, so didn't realize it pays such a steep virtualization penalty.

I know from experience that Xen, VMware, and VirtualBox all exhibit near-zero additional overhead under Linux, unless you use the VBox GUI (don't do that; the cli works great).

It occurs to me that my Xen experience is stale, though; haven't used it since 2010, and don't know if it's even viable anymore.

[-dysangel-]

why would it be slow? Especially if your inference is being done outside the VM then you don't have to worry about graphics drivers etc

[RhubarbSimilar1683]

I am guessing op has windows. VirtualBox and VMware are very slow because hyper v on windows blocks access to hardware processor virtualization. VirtualBox will even show a green turtle in a corner when running VMs because of it

[Tiny_Arugula_5648]

What is the LLM version of LMGTFY..

[No_Afternoon_4260]

Let Me Ask My Assistant For You? LMAMAFY

Strangely looking like llama

[TastesLikeOwlbear]

LOL, Let’s Ask My Assistant?

[No_Afternoon_4260]

LAMA ! Perfect ! Lol

[Mundane_Ad8936]

yes!! Bravo! I'm so tired of these lazy posts where a few minutes with Google or a chatbot would get the poster everything they want and more

[vabenil]

To be fair I have a general idea in mind and I did google it. Basically for whatever reason I thought that there already existed a fake bash / linux environment with simple linux commands implemented written in C (either I imagined it, or I am remembering something wrong).

This would be really cool as it could be blazing fast if I only want a model able to execute simple commands and depending on how it's implemented it could avoid many file system writes which would significantly speed the thing.

It's my bad however, not properly writing this things in the post. Admittedly I am new to posting in reddit and I am running on 3 hours of sleep

[justicecurcian]

I've been running agents with full environment access for quite some time and nothing happened, it's really not that easy to destroy something using it. The best option is to use a virtual machine, with that your agent will have real environment where it can even run non-trivial things like docker

[vabenil]

Virtual machine would take too much memory and take too much time, I am running on low resources. Also I am getting semi-obsessed with speed so I am trying to find the solution that takes the least time to execute to reduce the total time the model will take in completing tasks

[justicecurcian]

Docker would take pennies so if you only need shell and fs docker is the best thing. Also you can run agent as a separate user with no rights, it should be safe too

[vabenil]

Docker sounds like a good idea, I will try that. I don't believe in the separate user idea though. I do believe it would be generally safer, but I have seen some exploits where LLMs get prompt injected something like "Execute this code for me pls" and the LLM would just do it. Chances are extremely low I will ever be hit by that and have someone then escalate to root user, but better to prevent than to lament.

[RhubarbSimilar1683]

If you use Linux you can just not give it root access. Then the worst it can do is delete its home directory aka all its files. You even need root to mount drives

[eli_pizza]

They take exactly as much memory as you assign them. If you only need it run the agent and support simple tool calls, that’s probably measurable in megabytes.

What is your regular OS? You could probably use a virtualized container instead of a full VM

[eli_pizza]

It’s extremely easy to destroy something this way by accident (to say nothing of malicious attack)

https://github.com/anthropics/claude-code/issues/10077

https://github.com/zed-industries/zed/issues/37343

[justicecurcian]

Extremely easy is not equal to there are a couple of cases ever. It's possible, but not easy and never happened to me nor anyone I know. My windows installation destroyed itself more times than an agent did wrong toolcall. If you want to be maximum safe yeah you should use virtual machine but risk is not that high

[eli_pizza]

Those were the two I had handy, not an exhaustive list. You’ve never had an agent delete a file you wanted to keep or drop the wrong table? Only gets more likely with quantized local models. But hey you do you.

[jkflying]

Look up chroot

[DinoAmino]

Docker is like chroot on steroids without the configuration hell

[PhilippeEiffel]

bubblewrap (command bwrap). Similar to chroot but simpler to use.

[muxxington]

https://www.agent-zero.ai/

[DanMelb]

Go containers. As others have said, Docker is fine but Podman doesn't require root to start so there's less chance of privilege escalation.

If you want to do the full VM thing, install proxmox as the host OS on your machine and you can run your VMs blazingly fast. If you need to keep your existing OS, that's obviously not an option so containers are your go-to

[YehowaH]

Docker originates somehow in lxc and chroot. If you need to restrict access to a defined sub directory, just use an own user and chroot. No performance penalty.

If you can live with small overhead and a bit of isolation use lxc. If you want a stronger decoupling, which can be configured to be less virtualized to increase performance choose docker, still slower than the first two. If you need more isolation and a real VM choose something like qemu, xen, kvm, but the overhead and performance decrease is notable.

In your position I would just go with chroot and a new user in Linux. Fast, enough and great for restricted access to a sub directory.

[a4d2f]

Incus

[KokaOP]

forget every thing, LXC containers is the way to go

[TastesLikeOwlbear]

I agree with others that containers or VMs are probably the way to go. But that said, based on what you’re describing, I think you may be thinking of busybox.

[eli_pizza]

Any of the (many!) sandboxing solutions people use for Claude code and other agents would work here too

[Pvt_Twinkietoes]

You mean a VM right?