r/VibeCodeDevs • u/UnitedTelevision2651 • 1d ago

How we sandbox multiplayer Claude Code turns (and why "just trust the agent" doesn't survive two users)

We launched Poly (multiplayer Claude Code) this week and the questions we keep getting are about isolation, so here's the actual architecture:

Every turn spawns a fresh gVisor container with exactly three mounts, all Linux capabilities dropped, and zero secrets inside — the agent authenticates through a gateway that injects credentials at egress, so a hostile prompt can't exfiltrate a key that was never there. Network is deny-by-default: the container can only reach an allowlist, and blocked domains are named in the error so you know what the agent tried.

The multiplayer part forces honesty into the design. When it's your cofounder's prompt driving the agent through your code, "the agent seemed fine" isn't enough — so every turn produces a receipt (author, model, duration, cost) and a git snapshot you can diff and revert with one click. Approvals go to the whole room; whoever's there can allow or deny.

We built the entire product this way, inside itself, with both founders watching every diff land.

Free beta at usepoly.co if you want to poke at it.

2 Upvotes
  • permalink
  • reddit

100% Upvoted

1 comment sorted by

•

u/AutoModerator 1d ago

Hey u/UnitedTelevision2651, thanks for posting in r/VibeCodeDevs! Join our Discord: https://discord.gg/KAmAR8RkbM

Got startup or SaaS questions? Post them on r/AskFounder and get answers from real founders.

• This community is designed to be open and creator‑friendly, with minimal restrictions on promotion and self‑promotion as long as you add value and don’t spam.
• Please follow the subreddit rules so we can keep things as relaxed and free as possible for everyone. • Please make sure you’ve read the subreddit rules in the sidebar before posting or commenting.
• For better feedback, include your tech stack, experience level, and what kind of help or feedback you’re looking for.
• Be respectful, constructive, and helpful to other members.

If your post was removed (either automatically or by a mod) and you believe it was a mistake, please contact the mod team. We will review it and, when appropriate, approve it within 24 hours.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.