Lethal Trifecta

All AI agents must live in the Lethal Trifecta as coined by Simon Willison.

For programming assistants, who need to be online to install modules and to run tests this basically means they cannot have access to private information. So my solution is to run them in a podman container where they have read/write access to a directory where I also check out the code the agent should work on.

This is somewhat in contrast to the current meme of letting an OpenClaw assistant run with your credentials, your email address and input from the outside world.

Setup

My setup choses to remove all access to private data, since for programming an agent does not need access to any data that should not be publically known.

• Claude Code within its own Docker container
• Runs as root there
• Mount /home/corion/claude-in-docker/.claude as /root/.claude
• Mount working directory as /claude
• (maybe) mount other needed directories as read-only, but I haven't felt the need for that

Dockerfile

FROM docker.io/library/debian:trixie-slim
# debian-trixie-slim
RUN <<EOF
apt update

# Install our packages
DEBIAN_FRONTEND=noninteractive TZ=Etc/UTC apt-get install -y npm perl build-essential imagemagick git apache2 wireguard wget curl cpanminus liblocal-lib-perl ripgrep

# Install claude
curl -fsSL https://claude.ai/install.sh | bash

# Set up our directories to be mountable from the outside
mkdir -p /work
mkdir -p /root/.claude

# Now you need to /login with claude :-/

# claude plugins install superpowers@superpowers-marketplace

EOF

# Add claude to the search path
ENV PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/root/.local/bin"
ENTRYPOINT ["bash"]
CMD ["-i"]

Script to launch CC

Of course, the first thing an AI agent is used for is to write a script that launches the AI agent in a container. This script is very much still under development as I find more and more use cases that the script does not cover.

Development notes

While developing the script, I found that Claude Code very much needs example sections to work from. On its own, it comes up with code that is not really suitable. This mildly reinforces to me that the average Perl code used for training is not really good.