Hacker Newsnew | past | comments | ask | show | jobs | submit | kernc's commentslogin

`sandbox-venv` is a small shell script that sandboxes Python virtual environments in separate Linux namespaces using Bubblewrap (and soon using only command `unshare`, bringing the whole script down to effectively 0 deps).

https://github.com/sandbox-utils/sandbox-venv


Let everyone be reminded how joyful GIMP 2.10 menus used to look ...

https://i.imgur.com/nVyMQBt.png


If you mean the color icons, you can easily switch back to those in the Welcome Dialog that appears when you first open GIMP (look in the Personalize tab). It's the first thing I do when I install GIMP on a new machine. :)


oh wow, i never realized that this is there, in such a convenient location too. and you can't just change the icon style, but also disable the tool groups which was the most annoying change i found because it makes finding the right tool harder. (i'd love tool groups where the tools are grouped but not folded, or in a way where i can expand certain groups that i use often)


Thank you for this.

Also small world, floating point JPEG person here.


Ah, hey! We've been busy with getting 3.2 finished, but I plan to go back and read over your latest message once we've recovered a bit. :)


No rush - been busy over here too.


Did you also manage to enable menu icons?


That was a feature in GTK2 (the GUI library we use) that was removed in GTK3. We could try to fight the library and reimplement it ourselves, but it'd take a developer dedicated to do it. I miss the menu icons too. :(


It got deprecated only in 3.10 and you can compile against that and link it with the latest Gtk+ 3 library. I do this for my programs, because I don't like it when the widget toolkit ignores my OS settings.


Probably not. Maybe Bubblewrap and sandbox-run. It's an anything-is-already-way-better-than-nothing type of thing.

[0]: https://github.com/containers/bubblewrap

[1]: https://github.com/sandbox-utils/sandbox-run


As a heads up and affirmation that the approach is correct, here's a small shell bubblewrap wrapper that boils the command line down to `sandbox-run claude --dangerously-skip-permissions`.

https://github.com/sandbox-utils/sandbox-run


Other actionable insights are:

- Merge amendments up into the initial prompt.

- Evaluate prompts multiple times (ensemble).


Sometimes when I was stressed, I have used several models to verify each others´ work. They usually find problems, too!

This is very useful for things that take time to verify, we have CI stuff that takes 2-3 hours to run and I hate when those fails because of a syntax error.


Syntax errors should be caught by type checking / compiling/ linting. That should not take 2-3 hours!


Since everyone tends to present their own solution, I bid you mine:

    sandbox-run npx @anthropic-ai/claude-code
This runs npx (...) transparently inside a Bubblewrap sandbox, exposing only the $PWD. Contrary to many other solutions, it is a few lines of pure POSIX shell.

https://github.com/sandbox-utils/sandbox-run


I like the bubblewrap approach, it just happens to be Linux-only unfortunately. And once privileges are dropped for a process it doesn't appear to be possible to reinstate them.


> Linux-only

What other dev OSs are there?

> once privileges are dropped [...] it doesn't appear to be possible to reinstate them

I don't understand. If unprivileged code could easily re-elevate itself, privilege dropping would be meaningless ... If you need to communicate with the outside, you can do so via sockets (such as the bind-mounted X11 socket in one of the readme Examples).


I happen to use a Mac, even when targeting Linux so I'd have to use a container or VM anyways. It's nice how lightweight bubblewrap would be however.

Consider one wanted to replicate the human-approval workflow that most agent harnesses offer. It's not obvious to me how that could be accomplished by dropping privileges without an escape hatch.


It being deprecated and all, didn't feel like wrapping it, but macOS supposedly has a similar `sandbox-exec` command ...


IIRC from a comment in another thread, it's marked as deprecated to stop people from using it directly and to use the offical macOS tools directly. But it's still used internally by macOS.

And I think that what CC's /sandbox uses on a Mac


I wrote myself a handy and generalized bwrap-wrapping script: https://github.com/sandbox-utils/sandbox-run


No.1: Run untrusted code in a sandbox! https://github.com/sandbox-utils/sandbox-venv


Now that everyone is kindly on board, IBM can finally bury this standard. /s


What are the reasons for Snapchat? :.


Ladies


If you're above 25 (if not 20), Snapchat should be the last place to search for ladies...


I(1992) keep it because my younger family members(Gen Z>) refuse to use anything else to communicate.


You have my condolences


What's wrong with dating 20 -25 yr olds? LOL (central europe, millenial)


Honestly above 18-


Does not compute


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: