zuckerberg/nix-config
1
0
Fork 0
Code Issues Pull Requests Actions Activity

Rework Claude Code config in sandboxed workspaces

Browse Source 
Remove credential passing to sandboxes (didn't work well enough).
Move onboarding config init from host-side setup into base.nix so
each workspace initializes its own Claude config on first boot.
Wrap claude command in VM and Incus workspaces to always skip
permission prompts.
This commit is contained in:
Zuckerberg
2026-02-09 19:56:11 -08:00
parent cbf2aedcad
commit 8293a7dc2a
5 changed files with 40 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
common/sandboxed-workspace/container.nix
View File

@@ -47,16 +47,10 @@ in
hostPath = "/home/googlebot/sandboxed/${name}/ssh-host-keys";
isReadOnly = false;
};
# Per-workspace claude config for isolated session data
"/home/googlebot/claude-config" = {
hostPath = "/home/googlebot/sandboxed/${name}/claude-config";
isReadOnly = false;
};
# Share credentials from host (read-only)
"/home/googlebot/claude-config/.credentials.json" = {
hostPath = "/home/googlebot/.claude/.credentials.json";
isReadOnly = true;
};
};
config = { config, lib, pkgs, ... }: {