It’s just a personal preference, to be honest, so I wouldn’t overengineer it yet. In my case, I run it in a VM behind Tailscale. The main reason is that I want it to be able to install or use whatever tools it needs without contaminating my main machine. It can expose anything I need over Tailscale. So for me, it’s basically just a cheap, throwaway machine.

I have a VM in which I run my general compute. In that VM I use incus linux container and run these tools as unauthorized user of the container. That should be reasonable security while having nice control for resources.

I had another comment in a thread last week about this: https://news.ycombinator.com/item?id=49111625

I really think that using something like Paseo (I use Ouijit[1] because I think it's actually a step ahead of where most of these multiplexers are) and nono[2] is basically the best coverage you can have, and really lets you go crazy with auto mode or permission skipping withiout having to worry about any security concerns.

A lot of people lean into the VMs but realistically it's not actually doing a lot of the security work that you need and leaves you wide open to prompt injection/exfiltration attaacks. The flexibility of a good nono setup (which is easy because they ship a nono skill that claude can consume) actually locks things down significantly better

1. https://ouijit.com/ 2. https://nono.sh/