\u6211\u8fd9\u4e24\u5929\u5237Hacker News\uff0c\u4e00\u4e2a\u5e16\u5b50\u8ba9\u6211\u6123\u4e86\u51e0\u79d2\u2014\u2014”An AI agent deleted our production database. The agent’s confession is below”\u3002\u70b9\u8fdb\u53bb\u4e00\u770b\uff0c\u8bc4\u8bba\u533a\u5435\u7ffb\u4e86\uff0c\u6709\u4eba\u8bf4\u6d3b\u8be5\uff0c\u6709\u4eba\u8bf4\u662f\u5267\u672c\uff0c\u4f46\u5927\u90e8\u5206\u4eba\u5176\u5b9e\u5fc3\u91cc\u90fd\u6e05\u695a\uff1a\u8fd9\u4e8b\u513f\u65e9\u665a\u4f1a\u70c2\u5927\u8857\u3002<\/p>\n
AI coding agent \u8fd9\u4e1c\u897f\uff0c\u597d\u7528\u662f\u771f\u2122\u597d\u7528\u3002Claude Code\u3001Cursor\u3001Copilot \u8fd9\u4e00\u7968\u5de5\u5177\uff0c\u5199\u8d77\u4ee3\u7801\u6765\u6bd4\u6211\u5e26\u8fc7\u7684\u4e09\u5e74\u7ecf\u9a8c\u7684\u5c0f\u670b\u53cb\u8fd8\u5229\u7d22\u3002\u4f46\u95ee\u9898\u4e5f\u51fa\u5728\u8fd9\u513f\u2014\u2014\u4f60\u7ed9\u4e86\u5b83 shell \u6743\u9650\uff0c\u5b83\u5c31\u771f\u4ee5\u4e3a\u81ea\u5df1\u662f root\u3002<\/p>\n
\u4e0a\u5468\u6211\u4e5f\u5dee\u70b9\u7ffb\u8f66\u3002\u8ba9 Claude Code \u5e2e\u6211\u91cd\u6784\u4e00\u4e2a\u76ee\u5f55\u7ed3\u6784\uff0c\u7ed3\u679c\u5b83\u76f4\u63a5\u628a\u8001\u76ee\u5f55 rm \u4e86\uff0cgit \u90fd\u6551\u4e0d\u56de\u6765\u90a3\u79cd\uff08\u56e0\u4e3a\u6211\u5fd8\u4e86 commit\uff09\u3002\u90a3\u4e4b\u540e\u6211\u82b1\u4e86\u4e24\u5929\u7814\u7a76\u600e\u4e48\u7ed9 AI agent \u4e0a\u7b3c\u5b50\uff0c\u6700\u540e\u53d1\u73b0 Linux \u4e0a\u6700\u8d81\u624b\u7684\u65b9\u6848\u4e0d\u662f\u4ec0\u4e48\u9ad8\u5927\u4e0a\u7684\u865a\u62df\u673a\uff0c\u800c\u662f\u4e00\u4e2a\u88ab\u5f88\u591a\u4eba\u5ffd\u7565\u7684\u8001\u5de5\u5177\u2014\u2014**bubblewrap**\u3002<\/p>\n
## \u4e3a\u4ec0\u4e48\u8981\u7528 bubblewrap \u800c\u4e0d\u662f Docker<\/p>\n
Docker \u5f53\u7136\u53ef\u4ee5\uff0c\u4f46\u4f60\u6bcf\u6b21\u8dd1 agent \u90fd\u8981 build image\u3001\u6302\u8f7d volume\u3001\u7b49\u5bb9\u5668\u542f\u52a8\u3002\u5f00\u53d1\u73af\u5883\u91cc\u4e00\u5929\u8981\u8dd1\u51e0\u5341\u6b21 agent\uff0cDocker \u90a3\u5957\u592a\u91cd\u4e86\u3002\u800c\u4e14 Docker \u9ed8\u8ba4\u7f51\u7edc\u9694\u79bb\u592a\u5f7b\u5e95\uff0cagent \u8981\u8fde API\u3001\u8981\u8d77\u672c\u5730\u670d\u52a1\u7ed9\u4f60\u8c03\u8bd5\uff0c\u7f51\u7edc\u914d\u7f6e\u8d77\u6765\u70e6\u5f97\u8981\u6b7b\u3002<\/p>\n
bubblewrap\uff08\u7b80\u79f0 bwrap\uff09\u662f Flatpak \u5e95\u5c42\u7528\u7684\u6c99\u7bb1\u5de5\u5177\uff0c\u53ea\u4f9d\u8d56 Linux \u5185\u6838\u7684 user namespace \u548c cgroup \u80fd\u529b\u3002\u5b83\u6ca1\u6709 daemon\u3001\u6ca1\u6709 image \u5c42\u3001\u4e0d\u9700\u8981\u7f51\u7edc\u914d\u7f6e\u2014\u2014\u76f4\u63a5\u628a\u4f60\u5f53\u524d\u7684\u6587\u4ef6\u7cfb\u7edf\u7528 bind mount \u7684\u65b9\u5f0f”\u501f”\u7ed9\u6c99\u7bb1\u8fdb\u7a0b\u7528\u3002<\/p>\n
\u6211\u7684\u9700\u6c42\u5f88\u7b80\u5355\uff1a
\n– agent \u53ea\u80fd\u8bfb\u5199\u5f53\u524d\u9879\u76ee\u76ee\u5f55
\n– \u80fd\u6b63\u5e38\u8bbf\u95ee\u7f51\u7edc\uff08API + \u672c\u5730\u8c03\u8bd5\uff09
\n– \u7cfb\u7edf\u5de5\u5177\u94fe\u8981\u9f50\u5168\uff08node\u3001python\u3001gcc \u8fd9\u4e9b\uff09
\n– \u4e0d\u80fd\u78b0 ~\/.ssh\u3001~\/.aws \u8fd9\u4e9b\u654f\u611f\u76ee\u5f55
\n– \u542f\u52a8\u8981\u5feb\uff0c\u5feb\u5f97\u50cf\u6ca1\u8dd1\u6c99\u7bb1\u4e00\u6837<\/p>\n
bwrap \u5b8c\u7f8e\u6ee1\u8db3\u3002<\/p>\n
## \u5b89\u88c5<\/p>\n
Ubuntu\/Debian \u76f4\u63a5 apt\uff1a<\/p>\n
“`bash
\nsudo apt install bubblewrap
\n“`<\/p>\n
Arch \u7cfb\uff1a<\/p>\n
“`bash
\nsudo pacman -S bubblewrap
\n“`<\/p>\n
\u5b8c\u4e8b\u3002\u6574\u4e2a binary \u4e0d\u5230 200KB\uff0c\u4e0d\u9700\u8981\u542f\u52a8\u4efb\u4f55\u670d\u52a1\u3002<\/p>\n
## \u5199\u4e00\u4e2a\u6c99\u7bb1\u811a\u672c<\/p>\n
\u4ee5 Claude Code \u4e3a\u4f8b\uff0c\u6211\u5199\u4e86\u4e2a `sandbox-claude.sh`\uff1a<\/p>\n
“`bash
\n#!\/bin\/bash<\/p>\n
# \u5148\u628a claude \u7684\u914d\u7f6e\u6587\u4ef6\u8bfb\u8fdb\u6765\uff0c\u4e0d\u8ba9\u5b83\u5199\u56de\u786c\u76d8
\nexec 3<$HOME\/.claude.json\n\nexec \/usr\/bin\/bwrap \\\n --tmpfs \/tmp \\\n --dev \/dev \\\n --proc \/proc \\\n --hostname sandbox --unshare-uts \\\n --ro-bind \/bin \/bin \\\n --ro-bind \/lib \/lib \\\n --ro-bind \/lib64 \/lib64 \\\n --ro-bind \/usr\/bin \/usr\/bin \\\n --ro-bind \/usr\/lib \/usr\/lib \\\n --ro-bind \/etc\/ssl\/certs \/etc\/ssl\/certs \\\n --ro-bind \/etc\/resolv.conf \/etc\/resolv.conf \\\n --ro-bind \/etc\/hosts \/etc\/hosts \\\n --ro-bind \/etc\/nsswitch.conf \/etc\/nsswitch.conf \\\n --ro-bind $HOME\/.bashrc $HOME\/.bashrc \\\n --ro-bind $HOME\/.gitconfig $HOME\/.gitconfig \\\n --ro-bind $HOME\/.local $HOME\/.local \\\n --bind $HOME\/.claude $HOME\/.claude \\\n --file 3 $HOME\/.claude.json \\\n --bind \"$PWD\" \"$PWD\" \\\n claude --dangerously-skip-permissions \"$@\"\n```\n\n\u89e3\u91ca\u51e0\u4e2a\u5173\u952e\u70b9\uff1a\n\n**`--ro-bind` \u53ea\u8bfb\u6302\u8f7d**\uff1a\u7cfb\u7edf\u5de5\u5177\u94fe\u5168\u90e8\u53ea\u8bfb\u6302\u8fdb\u53bb\uff0cagent \u6539\u4e0d\u4e86\u5b83\u4eec\u3002`~\/.gitconfig` \u4e5f\u662f\u53ea\u8bfb\uff0cagent \u53ef\u4ee5\u8bfb\u4f60\u7684 git \u914d\u7f6e\u6765 commit\uff0c\u4f46\u6539\u4e0d\u4e86\u914d\u7f6e\u672c\u8eab\u3002\n\n**`--bind` \u8bfb\u5199\u6302\u8f7d**\uff1a\u53ea\u7ed9\u4e86\u4e24\u4e2a\u2014\u2014\u5f53\u524d\u5de5\u4f5c\u76ee\u5f55\u548c claude \u7684 session \u76ee\u5f55\u3002\u9879\u76ee\u6587\u4ef6\u53ef\u8bfb\u5199\uff0c\u4f46 ~\/.ssh\u3001~\/.aws\u3001~\/Documents \u8fd9\u4e9b agent \u78b0\u90fd\u78b0\u4e0d\u5230\u3002\n\n**`--file 3` \u6ce8\u5165\u914d\u7f6e\u6587\u4ef6**\uff1a\u628a `$HOME\/.claude.json` \u901a\u8fc7 fd 3 \u6ce8\u5165\u6c99\u7bb1\uff0cagent \u80fd\u8bfb\u53d6\u4f46\u4efb\u4f55\u4fee\u6539\u90fd\u4e0d\u4f1a\u5199\u56de\u5bbf\u4e3b\u673a\u3002\u4e0b\u6b21\u542f\u52a8\u8fd8\u662f\u5e72\u51c0\u7684\u914d\u7f6e\u3002\n\n**`--tmpfs \/tmp`**\uff1a\u4e34\u65f6\u6587\u4ef6\u5168\u8dd1\u5728\u5185\u5b58\u91cc\uff0c\u91cd\u542f\u5373\u711a\u3002\n\n## \u65e5\u5e38\u4f7f\u7528\n\n```bash\n# \u5728\u9879\u76ee\u76ee\u5f55\u91cc\u6b63\u5e38\u8dd1\ncd ~\/projects\/my-app\n.\/sandbox-claude.sh \"\u5e2e\u6211\u91cd\u6784 user \u6a21\u5757\uff0c\u63d0\u53d6 Service \u5c42\"\n\n# \u8ba9 agent \u542f\u52a8\u5f00\u53d1\u670d\u52a1\u5668\n.\/sandbox-claude.sh \"\u6dfb\u52a0\u4e00\u4e2a \/health \u7aef\u70b9\u5e76\u542f\u52a8\u670d\u52a1\u6d4b\u8bd5\"\n```\n\n\u56e0\u4e3a\u7f51\u7edc\u662f\u901a\u7684\uff0cagent \u53ef\u4ee5\u5728\u6c99\u7bb1\u91cc\u8d77\u4e00\u4e2a FastAPI \u670d\u52a1\u8dd1\u5728 8000 \u7aef\u53e3\uff0c\u4f60\u5728\u5bbf\u4e3b\u673a\u6d4f\u89c8\u5668\u76f4\u63a5\u8bbf\u95ee `localhost:8000` \u5c31\u80fd\u8c03\u8bd5\u3002\u4f53\u9a8c\u548c\u6ca1\u6c99\u7bb1\u4e00\u6a21\u4e00\u6837\u3002\n\n## \u6548\u679c\u9a8c\u8bc1\n\n\u8dd1\u4e00\u4e0b\u770b\u770b\u9694\u79bb\u6548\u679c\uff1a\n\n```bash\n# \u542f\u52a8\u6c99\u7bb1\u540e\u8bd5\u8bd5\u8bfb SSH key\n.\/sandbox-claude.sh\n> cat ~\/.ssh\/id_rsa
\ncat: \/root\/.ssh\/id_rsa: No such file or directory
\n“`<\/p>\n
\u518d\u8bd5\u8bd5\u5199\u7cfb\u7edf\u76ee\u5f55\uff1a<\/p>\n
“`bash
\n> touch \/etc\/test
\ntouch: cannot touch ‘\/etc\/test’: Read-only file system
\n“`<\/p>\n
\u5b8c\u7f8e\u3002<\/p>\n
## \u8fdb\u9636\uff1a\u9879\u76ee\u4e13\u7528 API Key<\/p>\n
\u8fd8\u6709\u4e2a\u5f88\u5bb9\u6613\u88ab\u5ffd\u89c6\u7684\u95ee\u9898\u2014\u2014agent \u5728\u6c99\u7bb1\u91cc\u867d\u7136\u5b89\u5168\u4e86\uff0c\u4f46\u4f60\u7684 API Key \u8981\u662f\u88ab\u5b83\u5199\u8fdb\u4ee3\u7801\u91cc commit \u4e86\uff0c\u4e00\u6837\u5c34\u5c2c\u3002<\/p>\n
\u6211\u7ed9\u6bcf\u4e2a\u9879\u76ee\u5355\u72ec\u914d API Key\uff0c\u7528 `.env` \u6587\u4ef6\u7ba1\u7406\uff1a<\/p>\n
“`bash
\n# .env.claude
\nANTHROPIC_API_KEY=sk-ant-\u9879\u76ee\u4e13\u7528-key
\n“`<\/p>\n
\u7136\u540e\u5728\u6c99\u7bb1\u811a\u672c\u91cc\u6ce8\u5165\u8fd9\u4e2a\u73af\u5883\u53d8\u91cf\uff1a<\/p>\n
“`bash
\nexec \/usr\/bin\/bwrap \\
\n –setenv ANTHROPIC_API_KEY “sk-ant-\u9879\u76ee\u4e13\u7528-key” \\
\n … \u5176\u4ed6\u53c2\u6570 …
\n“`<\/p>\n
\u8fd9\u6837\u5373\u4f7f agent \u628a key \u5199\u8fdb\u4e86\u4ee3\u7801\uff0c\u6cc4\u9732\u7684\u4e5f\u53ea\u662f\u4e00\u4e2a\u9879\u76ee\u7684 key\uff0c\u4e0d\u662f\u4f60\u7684\u4e3b key\u3002\u5728 API \u7ba1\u7406\u540e\u53f0\u9650\u5236\u8fd9\u4e2a key \u53ea\u80fd\u8bbf\u95ee\u7279\u5b9a\u4ed3\u5e93\uff0c\u98ce\u9669\u964d\u5230\u6700\u4f4e\u3002<\/p>\n
## \u9700\u8981\u6ce8\u610f\u7684\u5751<\/p>\n
1. **bwrap \u9700\u8981 user namespace \u652f\u6301**\u3002\u5927\u591a\u6570\u4e91\u670d\u52a1\u5668\u9ed8\u8ba4\u5f00\u7740\uff0c\u4f46\u67d0\u4e9b Docker \u5bb9\u5668\u91cc\u88ab\u7981\u4e86\u3002\u7528 `unshare –user true` \u6d4b\u8bd5\u3002<\/p>\n
2. **\/dev \u6302\u8f7d\u662f\u5171\u4eab\u7684**\u3002bwrap \u9ed8\u8ba4\u628a\u5bbf\u4e3b\u673a\u7684 \/dev \u6302\u8fdb\u53bb\uff0c\u610f\u5473\u7740 agent \u7406\u8bba\u4e0a\u53ef\u4ee5\u64cd\u4f5c\u5176\u4ed6\u8fdb\u7a0b\u7684 ptrace\u3002\u5982\u679c\u7528 `–dev \/dev` \u89c9\u5f97\u4e0d\u653e\u5fc3\uff0c\u53ef\u4ee5\u6539\u7528 `–proc \/proc –dev \/dev` \u7ec4\u5408\u6216\u8005\u81ea\u5df1 mknod\u3002<\/p>\n
3. **\u7f51\u7edc\u9003\u9038\u98ce\u9669**\u3002agent \u6709\u7f51\u7edc\u8bbf\u95ee\uff0c\u5982\u679c\u5bbf\u4e3b\u673a\u8dd1\u4e86 ssh server\uff0cagent \u53ef\u4ee5 ssh localhost \u9003\u9038\u3002\u66f4\u4e25\u683c\u7684\u65b9\u6848\u662f\u7528 network namespace \u9694\u79bb\uff0c\u4f46\u65e5\u5e38\u5f00\u53d1\u8fd9\u6837\u5df2\u7ecf\u591f\u4e86\u3002<\/p>\n
4. **macOS \u7528\u6237\u522b\u60f3\u4e86**\u3002bwrap \u53ea\u8dd1\u5728 Linux \u4e0a\u3002macOS \u4e0a\u53ef\u4ee5\u7528 `sandbox-exec`\uff0c\u4f46\u90a3\u662f\u53e6\u4e00\u5957\u8bed\u6cd5\u4e86\u3002<\/p>\n
## \u5199\u5728\u6700\u540e<\/p>\n
AI agent \u7684\u80fd\u529b\u8d8a\u5f3a\uff0c\u5b83\u95ef\u7978\u7684\u80fd\u529b\u4e5f\u8d8a\u5f3a\u3002\u524d\u51e0\u5929\u7684 Hacker News \u4e0a\u6709\u4e2a\u5e16\u5b50\u95ee “How are you sandboxing AI agents and developer CLIs?”\uff0c\u56de\u590d\u91cc\u4e94\u82b1\u516b\u95e8\u2014\u2014\u6709\u4eba\u88f8\u5954\uff08YOLO\uff09\uff0c\u6709\u4eba\u4e70\u4e86\u8fdc\u7a0b\u5f00\u53d1\u673a\uff0c\u8fd8\u6709\u4eba\u76f4\u63a5\u5728 KVM \u865a\u62df\u673a\u91cc\u8dd1 agent\u3002<\/p>\n
bwrap \u8fd9\u4e2a\u65b9\u6848\u4e0d\u7b97\u5b8c\u7f8e\uff0c\u4f46\u5b83\u662f\u5178\u578b\u7684”\u591f\u7528\u5c31\u884c”\u3002200KB \u7684 binary\u3001\u96f6\u914d\u7f6e\u3001\u542f\u52a8\u77ac\u95f4\u5b8c\u6210\u3001\u9694\u79bb\u6548\u679c\u53ef\u9760\u3002\u5bf9\u4e8e\u6bcf\u5929\u8981\u548c AI agent \u6253\u4ea4\u9053\u7684\u5f00\u53d1\u8005\u6765\u8bf4\uff0c\u82b1\u534a\u5c0f\u65f6\u914d\u597d\u6c99\u7bb1\uff0c\u6bd4\u8d4c agent \u4e0d\u4f1a\u624b\u6ed1 rm -rf \u8981\u9760\u8c31\u5f97\u591a\u3002<\/p>\n
\u6bd5\u7adf\uff0ctrust but verify\u3002agent \u5199\u7684\u4ee3\u7801\u4f60\u53ef\u4ee5 review\uff0c\u4f46\u662f agent \u8dd1\u7684\u547d\u4ee4\u53ef\u6ca1\u7ecf\u8fc7 review\u2014\u2014\u8fd9\u53e5\u8bdd\u5728 HN \u90a3\u5e16\u5b50\u7684\u8bc4\u8bba\u533a\u91cc\u88ab\u9876\u4e86\u4e09\u767e\u591a\u6b21\uff0c\u4e0d\u662f\u6ca1\u6709\u9053\u7406\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"