First lesson was that the architecture had to be secure in structure, not configuration. Otherwise, a novice will run claude code on the host machine and just bork the entire setup.

So now I've replaced tightbeam runtime with a small runtime on the workspace container. Tightbeam and Airlock have been moved to separate pods. So you don't need network egress on the workspace pod at all.

Secondly, I'm isolating credentials on Tightbeam and Airlock with k8s jobs. Rather than airlock full CLI commands, you just create "airlock tools" with k8s secrets. Airlock controller never sees the secret. The tool could be like "git-create-branch" and "gh-create-pr".

Tightbeam is pretty much symmetrical. LLM credentials are tied to jobs.

I'm tying them together into a unified architecture now. Please do let me know if you have additional thoughts!

https://github.com/calebfaruki/tightbeam https://github.com/calebfaruki/airlock

This is literally the thing I'm trying to protect against.

Comments URL: https://news.ycombinator.com/item?id=47494137

Points: 3

# Comments: 1

In Dockerized agent setups, prompt files, skills, and other in-container controls are not a real boundary. The agent can ignore or rewrite them.

Airlock replaces sensitive CLIs in the container with shims that send requests to a host daemon over a Unix socket. The host validates the request against policy and, if allowed, executes the real command there.

The goal is to let a containerized agent use tools like git, ssh, aws, terraform, or docker without the container holding the real credentials.

It’s not a general sandbox or a complete agent security solution. It solves a narrower problem: host-side enforcement for credentialed CLI access.

Comments URL: https://news.ycombinator.com/item?id=47424437

Points: 2

# Comments: 0

American living in France for 5 years. Previously worked in NYC startups earning a similar salary to you. Made lots of mistakes that, if I had known better, I could've saved myself some time and money. That being said, I am doing far better financially even if I make less on paper and I just bought my first place (unthinkable in NYC). I work as a software contractor technically, though I work full time for an American company.

Your first question is what your longterm goal? Permanent relocation or experiment for a few years? In other words, where are you planning to retire? You want to make your social security payments to the correct country. Your tax paperwork will stress you out for the first few years if you don't figure that out.

In either case, I'd suggest you try to keep your American job and go fully remote. You don't need a work visa if you don't work for a European company. But if you move permanently, you should do the paperwork to replace your American employment contract with a European contracting company like I did. It's more paperwork but earning an American salary in Europe gives you a significant purchasing power advantage even if you pay more in taxes. The real killer is the paperwork. European bureaucracy sucks.

If you don't keep your American job, you should apply for jobs before moving ideally. Most EU countries have reasonably low bars for skilled worker visas. Spain and France I know are very simple. The Netherlands are a bit more confusing. Regardless, you roughly need an offer of 50 000 € and a college degree to get one.

EDIT: saw discussion about housing shortages. France has tons of housing (https://pap.fr). I had a two-bedroom apartment with a balcony in Paris proper for 1 900 €.

The issue here is that Cloudflare's content type check is naive. And the fact that CF is checking the content-type header directly needs to be made more explicit OR they need to do a file type check.

You simply shouldn't have any challenges whatsoever on an RSS feed. They're literally meant to be read by a machine.

My company hired me to replace their terrible software vendor and by their own account it's been a clear success. I visit the factories and stores and work with the employees to tailor make the software for their needs.

We're finally about to hire our second developer next year using the money we've saved by ending out contract with our old software vendor.

We're even at the point now where we can sort of brag about it. Here's the customer story we did with Heroku: https://www.heroku.com/customers/leatherspa

I'm running a hand-rolled monorepo with ansible, terraform, and several language projects (JS/TS, Swift, Ruby) that each have a makefile to standardize entrypoints for CI/CD. Docopt is nice because it's self documenting so you can better understand how all your apps are deployed.

But for a non-programmer, it's understandable you don't want to be bother with the inner workings of your OS and how to maintain Ansible script idempotency.

And for every piece of software you want to run on your server, the idempotency task grows more difficult.

My honest opinion? Tolerate the learning curve for docker-compose. Each application you need can be managed and tweaked in isolation. Troubleshooting "works on my machine" problems will cost you more time in the long-run. You can't anticipate all the weird interactions between your programs and the os. Being able to nuke the setup and rebuild from scratch is your most valuable tool.

- thin base os (install just enough to run docker-compose)

- maintain images for each of your apps you need.

- mount the essential volumes of each image to well known location on your hard drive to make manual backups easy.

The town definitely has rules about how your home must look (if it's a new construction). Old houses don't though.

The town definitely empties out during the colder months but my wife and I still enjoy going there because it beats city living. Also they installed fiber optic internet not too long ago. Since we WFH, we try to go there as often as possible.

The chimneys are likely real but sealed because of climate change related rules.

There's also a castle that dates back to the 12th century built to protect monks from vikings. They've recently finished some restoration work there too.

For example, I looked at tires and wheels as a good litmus test. What were the minimum pieces of information that you need to know to pick the right tire or wheel and make those the only filters on the site.

In terms of expertise, I've mainly farmed out to the cyclist community on Mastodon and served requests on a first-come-first-serve basis. For example, one person pointed me to sheldonbrown.com for their article on tires and it was really illuminating.

https://builder.bike