My Paranoid Coding Machine Setup

The combination of running AI agents which can install and run anything with supply chain attacks / the Hackening has made me much more paranoid about my personal machine than I used to be. I've been slowly improving this, and finally moved all of my AI agents into a VM today. I'm sharing this to show how far you can take this, even if you have requirements like GPU access or the ability to run (something close enough to) Docker. This is a follow-up / longer version of a recent shortform. GoalsI run Claude Code in a custom harness which currently disables all permission prompts. I'm not really that worried about Claude doing something dangerous on purpose, but I worry about: • Claude breaking something by accident (mistyping a command that turns into rm -rf /).• Claude installing malware (most likely via a supply chain attack).My biggest worry is kernel exploits giving attackers access to my user account, allowing them to install a keylogger and steal my password manager vault[1]. Claude needs the ability to run Docker for testing, and shared access to my GPU for ML work. Non-GoalsTo get its work done, Claude needs access to many API keys (GitHub, OpenRouter, etc.). These keys are already as limited as they can be, and I limit the amount of API credits each key can access anyway because Claude doesn't understand the value of money. Agent VMI moved Claude agents to an unprivileged user account inside of an unprivileged VM. Any user that can run Docker can easily get root access (and root access within the VM makes sandbox escape much easier) so agents use rootless Podman instead. GPU drivers allow direct access to hardware, and assigning the GPU to a VM would prevent my computer from being used by humans, so the VM can't access the GPU directly. I access the UI for my agent harness from multiple devices over HTTPS via Tailscale. Agents can serve files by putting them in a specific folder, and I can access files directly using VS Code for the Web. GPU ContainerFor GPU