kosa8

kosa8 / Guides

Guide · Aider

Is Aider safe? How do I run Aider in a sandbox?

Updated

Aider edits files in your repository and, by default, commits each change to git, so /undo can take back its last commit. It also runs shell commands: the ones you give with /run and /test, a lint command after each edit (tests too, if you turn them on), and commands it suggests, which is on by default. Git undoes file edits, not what a command did to the rest of the machine, so run Aider in a container or virtual machine that has only the project folder and a limited network.

01Steps

  1. Start from a clean commit. Keep auto-commits on (the default). Aider also commits your own uncommitted changes before it edits, keeping them separate from its edits; --no-dirty-commits turns that off.

    terminal
    git add -A && git commit -m "before aider"

  2. Turn off what you do not need. --no-suggest-shell-commands stops Aider proposing shell commands. Avoid --yes-always, which answers yes to every confirmation.

    terminal
    aider --no-suggest-shell-commands

  3. Run it in a container. Aider publishes Docker images. The container sees the folder you mount at /app. Aider's docs note that /run then runs inside the container, and that the container lacks your global git config, so set user.name and user.email in the repository.

    terminal
    docker run -it --user $(id -u):$(id -g) --volume $(pwd):/app paulgauthier/aider --openai-api-key $OPENAI_API_KEY

  4. Or run it in a VM with a kit you write. kosa8 has no built-in Aider kit, and this one has not been separately tested. It gives Aider one folder, reaches only PyPI by name, and keeps your OpenAI key on your computer: the sandbox gets a placeholder and the egress broker adds the real key for api.openai.com.

    aider.yaml
    name: aider
description: Aider with one project folder and a brokered OpenAI key
image: python:3.12
setup:
  - python -m pip install aider-chat
command: [aider]
egress_allow:
  - pypi.org
  - files.pythonhosted.org
credentials:
  - name: openai
    upstream: https://api.openai.com
    secret: OPENAI_API_KEY
    header: Authorization
    scheme: "Bearer "
    env:
      OPENAI_API_BASE: "{{url}}/v1"
      OPENAI_API_KEY: "{{placeholder}}"
cpus: 2
mem_mb: 4096

  5. Read the plan, then run it. kosa8 refuses a kit whose setup runs an unpinned pip install unless you pass --allow-unpinned; pin a version you have reviewed in the setup line. --dry-run prints what the sandbox may see and reach without starting it. Flags go before the kit file.

    terminal
    curl -fsSL https://kosa8.com/install.sh | sh
export OPENAI_API_KEY=sk-…
kosa8 agent run --dry-run --allow-unpinned -w ~/code/api ./aider.yaml
kosa8 agent run --allow-unpinned --keep --name aider -w ~/code/api ./aider.yaml

  6. Checkpoint the machine before a risky step. From another terminal, save the whole sandbox, then rewind if a command breaks it. The shared folder is not rolled back, which is what Aider's git commits are for.

    terminal
    kosa8 checkpoint aider --label "before migration"
kosa8 rewind aider

02Is Aider safe to run on my own machine?

Aider runs with your user account's permissions, so any shell command it runs can read or change anything you can. Its edits are committed to git, but a command it runs, a test suite or a package install acts on your machine directly.

By default it lints files it edits, suggests shell commands and offers to add URLs it finds to the chat. Each is useful; each is also a way for text in a repository or web page to influence what runs. A container or VM limits that to the folder and hosts you chose.

03Is Aider's git auto-commit enough to undo what it did?

It undoes file edits in the repository and nothing else. /undo undoes the last git commit if Aider made it. Git does not restore packages a command installed, files outside the repository, ignored files such as .env, database contents or processes left running.

A whole-machine checkpoint covers the rest inside a sandbox: disk, memory and running processes. See how to undo what an AI coding agent did.

04What does the closed network add?

It decides where a command can send your code. In the kit above, the sandbox reaches PyPI and the model API through the broker, by name, and every other request is refused before it leaves your computer and written to the audit log.

Read refusals with kosa8 audit ls. If Aider needs another host, add it to egress_allow deliberately rather than opening the network.

05Other options

  • Aider's own Docker images. paulgauthier/aider and paulgauthier/aider-full; the simplest container route.
  • Docker or Docker Sandboxes with --network none plus a local model, for work that should not reach the internet.
  • gVisor or Kata Containers. A stronger boundary under the same container workflow on Linux.
  • A full VM in UTM or Lima. A long-lived development machine with Aider installed in it.
  • Cloud sandboxes such as E2B, Daytona or Modal. Fit when you want the work off your machine entirely.

06Sources