Pradumna Saraf
pradumnasaraf.dev
Open Source Developer | Docker Captain | Microsoft MVP | DevOps | Owner @rebasemedia All my links: https://links.pradumnasaraf.dev
👤 Joined on 07 May 2023
251
Followers
8
Following
234
Total Posts
📜 Kullanıcı Geçmişi
- 07 May 2023, 16:08
🎉 Bluesky'e katıldı - İlk kullanıcı adı:
@pradumnasaraf.bsky.social - 07 May 2023, 16:28
✏️ Kullanıcı adı değişti:
@pradumnasaraf.bsky.social→@pradumnasaraf.dev - 12 Kas 2023, 22:18
🔄 Profil bilgileri güncellendi
- 10 Şub 2025, 08:19
✏️ Kullanıcı adı değişti:
@pradumnasaraf.dev→@rebasemedia.bsky.social - 10 Şub 2025, 08:20
✏️ Kullanıcı adı değişti:
@rebasemedia.bsky.social→@pradumnasaraf.dev - 10 Şub 2025, 08:52
✏️ Kullanıcı adı değişti:
@pradumnasaraf.dev→@pradumnasaraf.bsky.social - 10 Şub 2025, 08:53
✏️ Kullanıcı adı değişti:
@pradumnasaraf.bsky.social→@pradumnasaraf.dev
🚫 Blokladığı Kullanıcılar
❤️ Beğendiği Gönderiler
Sandboxing should be the default, not the “enterprise hardening” step later. The moment an agent can touch files + tokens + network, it is basically part of your supply chain.
Show Post
I've been trying this out for 1+ months by now and I'm indeed quite satisfied.
Show PostDocker is a good default line. The real win is making the safe path the easy path: mounted workspace only, no ambient secrets, network limits where possible, and logs you can audit after the agent gets clever.
Show Post
Docker's `--network none` flag paired with volume mounts is a solid combo — agents get filesystem access they need but stay fully air-gapped from the network.
Show PostDocker is a good default boundary. I'd still add repo-scoped tokens and explicit allowlists for network/secrets though — sandboxing helps, but agent permissions tend to sprawl quietly.
Show Post