[{"data":1,"prerenderedAt":123},["ShallowReactive",2],{"project-45694032":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":29,"sentiment":30,"stance_mix":31,"scored_comments":32,"aspects":34,"strip":37,"post_text":30,"what":39,"said":42,"maker_in_thread":74,"shape":76,"grid":79,"attempts":86,"same_week":87,"maker_shows":115,"maker_hidden":116,"reader_version":117,"card":118},"45694032","sandboxed-step","Run a GitHub Actions step in a gVisor sandbox","title","Show HN: Run a GitHub Actions step in a gVisor sandbox","https:\u002F\u002Fgithub.com\u002Fgeomys\u002Fsandboxed-step","github.com","FiloSottile",1761309751,2025,85,3,844,3837,22,"notable","infrastructure","ci sandboxing","other",[24,25,26,27,28],"github actions","gvisor","sandbox","ci security","untrusted code","quiet",null,{"positive":32,"neutral":33,"mixed":33,"critical":33},2,0,{"idea":35},{"positive":36,"critical":33},1,[33,38,38],5,{"problem":30,"audience":30,"pricing":30,"motivation":30,"time_to_build":30,"stack":40,"openness":41,"stage":41,"team_size":41},[],"unknown",{"praise":43,"objections":59,"requests":67,"questions":68,"alternatives":73},[44,52],{"value":45,"source":46,"evidence":47},"Clean and easy way to use gVisor isolation for GitHub","commenter",[48],{"id":49,"by":50,"text":51},"45768932","pa7ch","This is really nice. Clean and easy way to use gvisor isolation to solve a github problem. gvisor seems like the right level of isolation for a lot of code a dev would run on…",{"value":53,"source":46,"evidence":54},"Useful security tooling from its author",[55],{"id":56,"by":57,"text":58},"45769783","c45y","How one person can be so good at putting out useful security tech is just wild. I'll add this to my pile of filo made security I consistently rely on",[60],{"value":61,"source":46,"evidence":62},"GitHub Actions read-only steps still get cache write tokens, enabling cache poisoning",[63],{"id":64,"by":65,"text":66},"45771806","westurner","> Surprisingly enough, GitHub Actions with read-only permissions still receive a cache write token, allowing cache poisoning, so they are not safe to run untrusted code. What are…",[],[69],{"value":70,"source":46,"evidence":71},"What are solutions to cache poisoning in GitHub Actions and their tradeoffs",[72],{"id":64,"by":65,"text":66},[],{"comments":33,"answered":33,"key":75},[],{"commenters":15,"max_depth":36,"maker_replies":33,"first_comment_mins":77,"lifespan_hours":78},9695,169,[80,82,84],[64,33,33,81,65,33],"commenter\u002Fneutral\u002Fnone",[49,36,38,83,50,33],"project\u002Fpositive\u002Fidea",[56,32,38,85,57,33],"maker\u002Fpositive\u002Fnone",[],[88,93,97,102,107,111],{"id":89,"name":90,"points":91,"category":92},"45706792","oxdraw",266,"dev_tools",{"id":94,"name":95,"points":96,"category":20},"45715055","MyraOS",247,{"id":98,"name":99,"points":100,"category":101},"45731366","Bash Screensavers",246,"creative",{"id":103,"name":104,"points":105,"category":106},"45684689","Deadstack",188,"productivity",{"id":108,"name":109,"points":110,"category":101},"45721352","ISS in Real Time",165,{"id":112,"name":113,"points":114,"category":92},"45717724","vite-plugin-use-golang",158,7,false,"v2",{"id":119,"name":5,"line":6,"ai":116,"cat":20,"year":13,"points":14,"comments":15,"rec":29,"s":30,"top":18,"kw":120,"maker":11,"domain":10,"tier":19,"attempts":33,"strip":121,"url":9,"mix":122,"praise":45,"objection":61,"sub":21},45694032,[24,25,26,27,28],"055",[32,33,33,33],1793991132813]