Docker is not a strong security boundary and shouldn't be used to sandbox like this

https://cloud.google.com/blog/products/gcp/exploring-contain...

Compared to what? Which one is superior?

Running npm on your dev machine? Or running npm inside Docker?

I would always prefer the latter but would love to know what your approach to security is that's better than running npm inside Docker.

By all means, run your npm in docker, but please stop telling others it's a secure way to do so.

I only said it is a defense-in-depth measure.

I definitely want to know how is it worse than running npm directly on the host

Those aren't the only options, my dude.

And what are good options that you use and that work on Linux as well as Mac OS?

Read this: https://kayssel.substack.com/p/docker-escape-breaking-out-of...

So the worst case is that you are back to running npm on your host. Right?

99% of this is inapplicable to this discussion because it's about misconfigurations.

Escapes:

- privileged mode (misconfiguration, not default or common)

- excessive capabilities (same)

- CAP_SYS_ADMIN (same)

- CAP_SYS_PTRACE (same)

- DAC_READ_SEARCH (same)

- Docker socket exposure (same)

- sensitive host path mounts (same)

- CVE-2022-0847 (valid. https://www.docker.com/blog/vulnerability-alert-avoiding-dir...)

- CVE-2022-0185 (mitigated by default Docker config, requires miconfiguration of capabilities)

- CVE-2021-22555 (mitigated by default Docker config, requires miconfiguration of seccomp filters)

default seccomp filters in docker: https://docs.docker.com/engine/security/seccomp/#significant...

privileges that are dropped: https://docs.docker.com/engine/containers/run/#runtime-privi...

---

I'll add this: Containers aren't as strong of a security boundary as VMs however this means that a successful attack now requires infection of the container AND a concurrent container-escape vulnerability. That's a really high bar, someone would need to burn a 0-day on that.

The bar right now is really, really low - blocking post-install scripts seems to be treated as "good enough" by most. Using a container-based sandbox is going to be infinitely better than not using one at all, and container-based solutions have a much easier time integrating with other tools and IDEs which is important for adoption. The usability and resource consumption trade-off that comes with VMs is pretty bad.

Just don't commit any mortal sins of container misconfigurations - don't mount the Docker socket inside the container (tempting when you're trying to build container images inside a container!), don't use --privileged, don't mount any host paths other than the project folder.

I don't think it's crazy to imagine a misconfigured production environment. I always see these same examples of how "containers aren't really secure" and they're very amateur sins to commit though, as you mention.

AFAIK a comprehensive SELinux policy (like Red Hat ships) set to enforce will also prevent quite a few file accesses or modifications from escapes.

Confusingly, Docker now has a product called "Docker Sandboxes" [1] which claims to use "microVMs" for sandboxing (separate VM per "agent"), so it's unclear to me if those rely on the same trust boundaries that traditional docker containers do (namespaces, seccomp, capabilities, etc), or if they expect the VM to be the trust boundary.

[1]: https://www.docker.com/products/docker-sandboxes/

Aside: I really like the graphic on this and the linked homepage.

As a European working in a university on EU funded projects, I'm not sure how I've not heard of this before :/.

Thank you for clarifying this.

This is on their website...

"Is Kimi K2.5 open source?"

"Yes, Kimi K2.5 is an open source AI model. Developers and researchers can explore its architecture, build new solutions, and experiment openly. Model weights and code are publicly available on Hugging Face and the official GitHub repository."

https://www.kimi.com/ai-models/kimi-k2-5

4th paragraph in license block

Our only modification part is that, if the Software (or any derivative works thereof) is used for any of your commercial products or services that have more than 100 million monthly active users, or more than 20 million US dollars (or equivalent in other currencies) in monthly revenue, you shall prominently display "Kimi K2.5" on the user interface of such product or service.

My first reaction was "well, who knows how much revenue they're actually doing"

But at least the rumor mill has them significantly above that line:

> Revenue: As of March 2026, reports suggest Cursor has surpassed $2 billion in annualized revenue (ARR).

That's not an open source license, then.

It wouldn't be regardless, because the model is open weights, not open source. It's just a license.

Which contradicts what they say on their website.

Correct. (and I know you already know this but just for the record: (Nearly?) Everybody abuses the term "open source" when it comes to models. OSI have a post about it: https://opensource.org/ai/open-weights

Although it is not OSI approved, the license theoretically didn't add any more restrictions beyond attribution, which stays in line with The Open Source Definition.

That's debateable. How about, e.g, "10. No provision of the license may be predicated on any [...] style of interface."

Anyway, if it was clear cut, it shouldn't be difficult to get it approved.

These kinds of discussions show why it's a pain to use non standard licenses.

Why not?

This 'Modified MIT' is not a license that has been through the OSI process: https://en.wikipedia.org/wiki/The_Open_Source_Definition#Com...

You can't just add random terms to an existing license and use its name. "Modified MIT: Like MIT but pay us 50 million dollars."

Perhaps CC-BY would've been more appropriate.

Correct again -- CC- applies to data, not code -- weights are data, open weights suggests a creative commons approach …

“ CC-BY 4.0 Creative Commons Attribution 4.0 International

This license requires that reusers give credit to the creator. It allows reusers to distribute, remix, adapt, and build upon the material in any medium or format, even for commercial purposes.

BY Credit must be given to you, the creator. ”

it's annoying the open source term is being cargo-culted around and I hate to say it but that ship looks like it has sailed.

funny that free software people were infuriated by the open source term and now the open source term is being completely misused in another context

Ah yes, a document titled "*THE* Open Source Definition", describing *THEIR* definition of open source.

Their definition matters more than most, I mean, anyone can define anything however they like. Hell, Windows is open-source, because I said so.

Also, even if it were not for the OSI, this still wouldn't be open source. Because there's no source code available. It's open-weight, which is a different thing. The models weights are, essentially, the "compiled" output. The input and algorithms, we don't know.

Cursor have said they are using Composer through their inference provider (Fireworks). Presumably the MIT is not viral like the GPL, so Cursor, and companies that use Cursor do not need to display Kimi attribution on their products.

It's definitely not what Kimi wanted, but it sounds like this is what is written.

How so?

LLMs have been garbage for real work until very recently. Doesn't this show they were adopted too soon at amazon?

They're still garbage for real work.

Unironically this is probably the future of the web. The Ryanairs of the world get to inject their ads/upsells into the MCP response. The AI corps don't have their agents banned for scraping.

> And over that time I've worked in many places around the world, developing countries, tropical islands, small huts on remote mountains. And I've lost maybe a day of work because of connectivity issues. I've been deep in a rainforest during a monsoon and still had 4g connection.

cries on a Bavarian train

If it's any consolation, Bavaria is a beautiful part of the world that's up there with any tropical island or rainforest. I hope to visit again sometime.

Ha, true :-)

I've had some good initial results in going from typst to .tex with Claude (Opus 4.5) for an IEEE journal paper - idiomatic use of templates etc.

The Internet?