It doesn’t take much effort to remain relatively safe on the internet so you don’t have to resort to dedicated hardware just for banking. Don’t install sketchy apps that you don’t need and stop clicking on every link that you see – that’s pretty much it. I found that this basic internet hygiene has a nice side benefit as well – it forms a habit of avoiding superfluous and/or crappy content altogether.
I’m using this setup for my own projects but I suppose this setup could work in a work context as well if we’re talking about a work laptop with all of the project files already on it. In that case, I don’t see how spinning up a local VM and serving those files to the host would allow for data exfiltration, unless I’m misunderstanding you.
I’ll definitely have to try this. SSHFS didn’t work well for me when sharing files from the host to the guest but it might just work when sharing from the guest
More specifically, I’m having trouble seeing the issue with this approach if you’re, say, working on a laptop that has your project files and decide to spin up a local VM, place the files inside it and share them with the host via NFS/Samba/whatever.
I am the author. :) I’ve clarified my use case at the top of the article. I’m not connecting to remote VMs or anything of the sort, all of this is happening in a local VM so the data exfiltration point does not seem to apply (unless I misunderstood your point).
Yeah, I hear you. I try to avoid pulling NPM packages that I don’t know so I’m not really interested in containing software for security purposes.
Of course, there’s also the question of dependencies. If I’m working on a project that I trust that pulls in hundreds of NPM dependencies, I implicitly trust that the project deemed those dependencies safe to pull in. It would be impossible to always operate on the assumption that you’re potentially pulling in hundreds of malicious packages so the chain of trust has to take over at some point.
However, I imagine you were more or less referring to singular projects that you don’t fully trust and like to experiment with in which case I agree with you and would probably use a VM without any kind of file sharing tbh.
Fair enough. I have clarified my use case at the top of my article to reflect my threat model. I don’t use the VM to run tricksy software I don’t trust so the sandboxing argument doesn’t really apply in my case (or rather it doesn’t apply any more than when running software directly on the host). All of the software I run on my VMs is the same software I would run on my host (if the host was Linux-based).
An addendum: if you’re worried about the guest setting up a malicious git hook that your host would then execute, then your threat model is obviously very different from mine. Perhaps I should have clarified that I’m running code that I trust inside the VM so sandbox escape is not really a security issue in my case (but rather an operational one if, for example, a misbehaving script causes havoc on the host in this way).
Path mapping on PhpStorm was very tricky for me as well (I’m running Docker containers inside my VMs so I had to set up correct mapping in PhpStorm if I wanted to run tests from the IDE) and I’m only talking about regular file paths here (no \\wsl$\ prefixes)…
Correct me if I’m wrong, but isn’t it a bit pointless to worry about data exfiltration when we’re already talking about mounting (and, by extension, sharing) directories?
This doesn’t work for me because I find the Ubuntu desktop experience to be quite horrible. It’s very janky way too often. I very much prefer working with headless Ubuntu instances since this is where Linux excels for my use cases. For GUI stuff I look elsewhere.
My use case is rather specific (web development) and my recommendation is of course not intended to cover all possible use cases. However, if you’re working on web projects and need VMs to isolate your development toolset then this is the approach I choose after years of experimentation.
If I understand you correctly, then yes, I have eventually decided that I should only compromise on performance where it hurts less, e.g. for IDE access. If you’re running your application on a web server inside the VM for example, then this is the place where you probably need the best performance possible since this is where you’re going to feel it the most.
Not Windows specifically. I work on a macOS host so NFS works fine. However, I want to keep my options open for working on a Windows host if necessary and I wanted to keep to the toolset that already exists on the platform. I want to isolate as many responsibilities as possible inside the VM and then use a client on the host to mount the directory. Bonus points if the host already comes with this client out of the box.
Also, while I’m at it – if you’re using VMs for isolating potentially insecure things then your threat model is obviously different. I should have mentioned that I’m using VMs mainly for practical reasons, e.g. for easily spinning up Ubuntu environments with my preferred toolset. If you’re worried about something escaping the VM sandbox via git-hooks then your use case is of course very different.
PhpStorm has the Jetbrains Gateway which allows running the IDE on the VM and connecting to it using a client on the host. However, I found this to be a rather clunky approach when working on a local VM. I could imagine it working well if you’re developing on a remote machine but for local use cases this feels like an overengineered approach.
It isn't if you’re more interested in better performance during runtime. I can tolerate a certain delay when my IDE writes to a file on the host but I need the best performance when my app is running.
Edit: the point here is about shifting the area of compromise. I would very much prefer to compromise on IO performance when writing/reading files with my IDE rather than sacrifice the web server performance on the guest.
Depends on your requirements, I guess. I wanted a solution that would allow me to work with Linux ACLs and symlinks as well as get me the best possible performance so going native was basically the only choice. I started from this and then basically just worked around this premise. The only alternatives here were 2 – file syncing or sharing a directory with the host.
Also, regarding VirtioFS: this is indeed something I have not yet tried. I’m wary of this though because this requires installing additional drivers on Windows and I usually prefer using tools that are already at my disposal (e.g. Samba on Windows).
The point I was trying to make in the article was more about reversing the direction of mounts so that instead of mounting a host directory on the guest you share a directory from the guest and mount it with a client on the host. You can achieve this using whatever – NFS, Samba, etc. This is obviously not a new concept but I find it astonishing that perhaps the majority of articles on the internet always talk about mounting a host directory on the guest which is problematic due to the reasons I covered in my article.
The main advantage of this approach is that your code resides on a native file system. This allows you to take advantage of this performance gain where it matters most, which for me is during runtime (I develop web applications and IO performance is of paramount importance). I care much, much less about performance on the host side.
I didn’t know about Guestfish, thanks for the reference!
Yes, virtio-fs is an option but I should have added that one of my goals was to not lock myself into a platform… I want to have the possibility of running my VMs on Windows as well and Samba seems like the easiest choice there. Just spin up a Samba share inside the VM, mount it on the Windows host and you’re good to go. No need to install any additional dependencies on the host.
I’ve tried the Windows NFS driver for Vagrant a while back and my conclusion is that it’s best not to force a square peg into a round hole… Not to mention that these custom solutions can experience software rot throughout the years.
Are you referring to bidirectional syncing built into Jetbrains IDEs? If so, I have mixed feelings about it.
I gave this setup a go with PhpStorm. Host-to-VM sync is pretty seamless but you always have to manually sync changes from the guest to the host, so there’s that. Additionally, syncing can be very slow on large directory trees. I often found myself staring at a loading animation waiting for the IDE to catch all the changes and sync them to the guest.
AFAIK it is not recommended to open a project located on a network drive in a Jetbrains IDE but my experience with it so far has been great. Latency is not a concern because the VM is local.
Most importantly, I wanted to avoid a syncing situation where you have the source and the destination with two possibly differing states. This difference implies the possibility of conflicts which complicates things even further.