Is it necessary to use VNET to run a fully privileged AI agent in a FreeBSD jail?

A

Annalesa

I want to use ds4.1f, gpt6luna/sol, and deepseek harness to modify code and repeatedly power the OpenBSD bhyve guest on and off for testing, to realise root on hammer2 openbsd.
But I'm afraid the AI will disrupt the host's network and cut itself off from the API
 
I run claude code as an unprivileged user in a jail, typically with --permission-mode auto but occasionally with bypass instead. I do this so that I can edit jail files directly from my host.

Another person I know runs it as root in a VM.

I believe there is more risk when running in a jail, because there's more likely to be an undisclosed jailbreak that the could use.
 
As far as I know, a VNET isn’t actually necessary just to ensure the host’s network security, since even a user with root privileges in a standard jail cannot interact with the host’s network interfaces. But if the agent is going to run bhyve guest systems inside the jail, you’ll likely still need a VNET for network connectivity. I would keep the agent unprivileged with doas rules solely for working with virtual machines and take snapshots of the jail dataset before each launch so that I can roll back if something goes wrong.
 
You must log in or register to reply here.
Back
Top