bernd/vibepit

Run AI coding agents in isolated containers with network filtering.

What's novel

Run AI coding agents in isolated containers with network filtering.

Code Analysis

11 files read · 3 rounds

Launches AI coding agents in isolated Docker/Podman containers with a filtering proxy that enforces domain allowlists over HTTP, HTTPS, and DNS, plus an SSH daemon mode with persistent PTY sessions that survive client disconnects.

Strengths

Exceptional depth in the hard parts: a concurrency-safe PTY session manager with VTE scrollback replay, a multi-layer network filter (allowlist + CIDR + DNS-rebinding defense) with mTLS control API, and a full SSH server with session selector and keepalive — all with careful race-condition handling and detailed comments explaining why each synchronization choice was made.

Weaknesses

The container security hardening (read-only rootfs, dropped capabilities) is claimed in the README but the actual Docker container config that enforces it lives in the truncated portion of container/client.go, so I could not verify the specific security flags; the project also has a known upstream race in vt-go that the Makefile explicitly tolerates rather than fixing.

Score Breakdown

Innovation

6 (25%)

Craft

80 (35%)

Traction

25 (15%)

Scope

94 (25%)

Signal breakdown

Innovation

Not Fork+1

Code Novelty+1

Concept Novelty+2

Craft

Ci+5

Tests+3

Polish+2

Releases+4

Has License+5

Code Quality+27

Readme Quality+12

Recent Activity+7

Structure Quality+5

Commit Consistency+5

Has Dependency Mgmt+5

Traction

Forks+6

Stars+12

Hn Points+0

Watchers+0

Early Traction+5

Devto Reactions+0

Community Contribs+2

Scope

Commits+8

Languages+8

Subsystems+15

Bloat Penalty+0

Completeness+7

Contributors+6

Authored Files+15

Readme Code Match+3

Architecture Depth+7

Implementation Depth+8

Evidence

Commits

239

Contributors

Files

178

Active weeks

TestsCI/CDREADMELicenseContributing

Repository

Language

Stars

Forks

License

Apache-2.0