Top
Best
New

Posted by ozkatz 3 days ago

Show HN: Tilde.run – Agent sandbox with a transactional, versioned filesystem(tilde.run)
199 points | 132 commentspage 3
digitaltrees 3 days ago|
Interesting project. I am building an IDE for my phone and browser (www.propelcode.app) and have evaluated a few container architectures and providers. It was quite painful to get a prototype working. I will try your platform and would be happy to give feedback.
ozkatz 3 days ago|
Much appreciated! and good luck with your project
digitaltrees 3 days ago||
What’s the best way to give you user feedback? What would be most helpful? What’s your ideal customer profile?
ozkatz 3 days ago||
oz dot katz at treeverse.io would be best. ICP is SMB/mid-sized ISVs.
gverrilla 3 days ago||
I'm far from an expert on the field or in computer science, but from my limited perspective I don't see the need for sandboxing - after thousands of claude code interactions it never did nothing wrong that was serious, at all. If I understand this all correctly, lakeFS would be useful for versioning huge dataloads - but it's not my case: for my usecase I use dura and that's plenty, and for more serious projects where I want not only to version changes but also to 'journal' them, I use github. Also I don't understand one thing: this is like a different client? The website shows a screenshot of "Claude Code" that is not claude code at all, or is modified - that's not a terminal. Am I tripping in anything I said?
languid-photic 3 days ago||
Agreed. As alignment improves, I'm becoming increasingly bearish on sandboxing.

Version control and isolation will probably stay useful, though, more for distributed development and workflow reasons than for safety.

chickensong 2 days ago||
You're basically saying there's no need to wear a seatbelt because you've driven thousands of times without an accident. Claude is pretty well behaved, but it's not guaranteed to be safe, especially as you start to hit the gas and relinquish more control. Hope for the best, but plan for the worst and all that. Just because your use case doesn't need sandboxing, doesn't mean there's no need for sandboxing.
gverrilla 2 days ago||
I'm not having a debate because I'm quite ignorant of the subject. Just trying to learn from you: wouldn't recoverability and observability suffice instead of sandboxing, if such events are indeed rare? not necessarily for all usecases, but for most?
chickensong 2 days ago||
Yeah, I'm sure the reality is that a basic setup is fine for most casual development. The average user isn't concerned with security and we've basically normalized data breaches. If you have backups, use git, and manually approve Claude's access and actions, that's likely "good enough".

The problem is you start getting comfortable and tired of your workflow getting interrupted when the agent needs more/repeated access. Gradually the permission scope increases, or you decide to take the guards off completely. At this point you have a non-deterministic black box with internet access doing things to your computer. Maybe the agent gets confused and force-pushes git, maybe you load load a malicious plugin, or MCP to github and ingest something hostile. The internet isn't getting kinder, it's basically all-out war behind the scenes, and having your agent do online research is an attack vector. Security is layered, and sandboxing is a layer you can add to mitigate some issues and have piece of mind.

TBH I didn't look too closely at the featured product because I have my own solution already, but it sounds like a versioning filesystem is integrated, which can be really handy. Filesystem snapshots are fast and cheap compared to traditional backup/restore operations. Git is a nice layer for text files, but it's slow and not very good for binary stuff, so if you're working with images or 3d models etc, a versioning FS is really useful.

There are lots of agent use cases beyond individual coding. Maybe you're building a multi-tenant product that let's user agents do stuff and you need an undo feature. That's probably a good case for a sandbox with versioning FS. Maybe you have an agent handling contractual transactions that can't afford to oops. LLM agents are an entirely new computing interface, so we should imagine wide variety of use cases, some of which would likely benefit from a sandbox environment that versions data.

gverrilla 1 day ago||
Makes a lot of sense. Thanks!
chickensong 1 day ago||
Cheers!
wyre 3 days ago||
Interesting. Literally saw a tweet talking about exactly this last night.

Not sure how I feel about it using on your hosted service, while your home page is asking me for analytics data and only the cli and sdk are open source.

ozkatz 3 days ago|
Fair enough - the underlying technology is indeed open source (https://github.com/treeverse/lakeFS) - the service provides the hosting and tooling to make it easy for consumption by agents.
wyre 3 days ago||
Thats a cool project. I didn't scroll down far enough to see that. Thanks for the correction

I get providing a hosted service, but I don't understand how it makes it easier for agents to consume unless you're hosting an MCP? My understanding is an agent skill and a cli tool is all an agent needs?

ozkatz 3 days ago||
The repository itself get fuse-mounted into the running sandbox - no skill or MCP required to interact with data: an agent can simply `cat <file>` and use whatever tools they are already good at using.
stronglikedan 3 days ago||
> Free to start

Before I invest my time into something like this I'll need to know what it'll end up costing in the end. Perhaps it's just that "private previews" aren't for me. Good luck!

mc-serious 3 days ago||
Nice, I think that's pretty neat. Do you have an idea where to take this further? I.e. for the filesystem it's great but what if you need to touch external systems that keep their own state?
ozkatz 3 days ago|
In a perfect world, every system and external API would expose a standardized interface for versioning its own immutable state, so you'd be able to rollback and time travel across multiple such systems.

Not sure what else we can do in this world other than tightly control outbound requests and provide enough visibility into those requests for a human|agent to try and undo changes.

Happy to hear your thoughts - what would you like to see us take this?

mc-serious 3 days ago||
Yeah tbh I think this might be close to impossible to do as it probably 1) requires alignment that every stateful system needs a rollback capablity 2) it needs to be standardized which will probably take a minimum of 2 years after consensus (and that's probably conservative).

I'd love to learn more on how egress can be handled securely in sandboxes, and in general also ingress as this has some security impact - as soon as you allow reading from an external system you open up a new threat vector. Curious to understand whether you have any strategy for network access?

ozkatz 2 days ago||
That’s the current RBAC implementation: agents by default can make no API calls. the only way for them to contact the outside world is through a forward proxy configured in the sandbox. that proxy only allows making requests to destinations explicitly allowed (host, path, method)
mehmetkeremmtl 3 days ago||
The versioned filesystem is exactly what's missing when agents hallucinate and go off the rails. How fast are the rollbacks if an agent completely messes up the directory state?
ozkatz 2 days ago||
very very fast: proportional to the count of objects modified, but not their size. Every commit represents a snapshot - an immutable listing of objects that represents the repository. reverting is essentially applying the inverse of the diff introduced by the reverted commit.

This is metadata only as the objects themselves are immutable.

gitaarik 2 days ago||
Wasn't git invented for these kinds of things?
kindev 2 days ago||
Wow, I see a lot of potential with this project! Using the filesystem simplifies the integration with 3rd parties significantly.
pwr1 3 days ago||
This looks pretty useful. The versioned filesystem part is nice becuase that’s exactly where a lot of agent stuff gets messy fast.
clearstack 3 days ago||
If an agent deletes something important (e.g. database), can you undo it? Does it automatically backup before making changes?
ozkatz 3 days ago|
If that database is stored on the transactional filesystem available to the sandboxes, yes! Instead of backing up, it utilizes an efficient snapshot mechanism (lakeFS under the hood).
zuzululu 3 days ago|
more tools I will never use or need theres just an endless supply of new open source projects now I stopped paying attention

I increasingly feel the impact of landing on the frontpage of HN is not as pronounced as it used to be. The demographic shift of HN is also noted, it has a lot more "reddit" vibe than I remember.

redlewel 3 days ago||
Before all the vibecoding when I saw some project even if I thought it was dumb or didn't appeal to me, there was still a level of respect for it because at least someone put the effort in to write the code and at least attempt to understand what they were doing. The more they understood they more they learned about programming even if the project itself isn't super useful for others.

Now I see these things and its more likely than not that it was spit out by an agentic tool with little to no understanding of the code, and hardly learning or effort took place. Feels cheap and a waste of time. Why spend my time looking at something that someone made in a few hours so they could up their fake portfolio?

Its great to find real development out there but these types of posts eg "Show: random agentic tool gibberish" feel cheap and flaccid now. Nothing impressive

trollbridge 3 days ago|||
Kind of sad, because I can't think of anywhere that's replacing this.
Karrot_Kream 3 days ago||
tbh I think open internet forums are just dead. It was fun while it lasted but the reason it was good is because of the gatekeeping conditions (not to say that the gatekeeping didn't push away valuable contributors) that kept the internet forums hard to access.

GCs, blogs, and small chatrooms are the way.

zuzululu 3 days ago|||
already on HN I am seeing a lot of generated or AI assisted comments. on Reddit, sometimes I will engage in a debate then it gets drawn out and I realize I am talking to a bot.

perhaps the biggest hit is the trust, now people will just jump to conclusion and say your comment is AI and overall the presence that I used to feel from before the AI days is not there.

its no longer rewarding and ironically i've started to engage a lot less and seek human connections outside so perhaps there is an upside.

I also see a lot of people cutting back on instagram and social media use. AI appears to be slowly driving people off the internet and towards analog real human connection but its very subtle and too little to celebrate

Karrot_Kream 3 days ago||
> I also see a lot of people cutting back on instagram and social media use. AI appears to be slowly driving people off the internet and towards analog real human connection but its very subtle and too little to celebrate

I think it was bound to happen. The open internet is like public infrastructure with no janitor. People rant on it, people lie on it, people push zealous activism on it, people send bots onto it. The amount of work it would take to effectively moderate this stuff wouldn't make it economically viable to run any site. You'd need a full time staff just to police this stuff.

Small groups are small enough to be moderated by everyone in the group. It might feel sad (it certainly feels sad to me), but I think we should realize we just happened to be on the internet in a weird moment where a high bar was needed to get onto it that happened to align around norms of good discussion. I'm struggling with this transition (because it's hard as an adult to find new places to socialize), but need to ween myself off this site because it's obvious the quality has dipped too low to get much out of it.

dandaka 2 days ago|||
why can't we simply raise the bar for posting? I remember semi-open platforms, where you were invited, had to earn the right to post comments and posts. and you could easily lose those rights when downvoted. its seems strange in the AI-bot era that we allow any entity the freedom of speech.
Karrot_Kream 2 days ago||
That's essentially how most small chatrooms work these days. Join a bigger GC or small Discord/Matrix/IRC and bad behavior gets flagged with impunity. But most of the big web forums like HN, Reddit, etc predate that and moving to a model like that would pretty much kill the sites as we know them.
stronglikedan 3 days ago||
there's always been an endless supply of open source projects, but I think you'd be hard pressed to find an open source replacement for this project
verdverm 3 days ago||
There are dozens or hundreds of sandbox projects and companies now. It's the new vector database / agent memory until people notice OCI can do most of this and is already widely adopted in industry.
More comments...