Post

I've been running coding agents in VMs, and the worst part was always credentials. Either I pasted a token into the VM and hoped, or I did everything myself. So I built foca. It's basically ssh-agent for secrets: the VM asks, I tap Touch ID, it gets the token. github.com/bpinto/foca

12/10/26, 3:16 pm0 reposts1 like

Bruno Pinto

@bpinto.com

When something in the VM wants a secret, I get a Touch ID prompt on my Mac saying which secret, which VM and which program. On Linux it's the normal polkit password dialog. If I say no, it gets nothing.

Bruno Pinto

@bpinto.com

The prompt tells you who's asking. If the kernel can confirm the process, it shows it plainly. If it only has the VM's word for it, it says so: "gh via claude (unverified)". A caller can't sneak its own text into the prompt either.

Bruno Pinto

@bpinto.com

Each VM or container gets its own socket and its own vault. If a secret isn't exposed to that VM, asking for it looks exactly like asking for one that doesn't exist.

Bruno Pinto

@bpinto.com

My favourite bit: actions. Some things shouldn't be a token sitting in the VM, like AWS creds. So the host runs granted for it, with a fixed command and a checked profile name, and the VM only gets the short-lived output. credential_process = foca exec aws-creds --param profile=dev-admin

skilldb.bsky.social

@skilldb.bsky.social

Nice, the unverified label is the right call. One thing to check is whether a grant gets reused silently across sessions, since that's where these usually erode.

Bruno Pinto

@bpinto.com

Grant reuse is off by default, but you can specify a grant duration where every binary on the guest would be able to use that grant, unfortunately there is no way to avoid. For that, the best is to use the default and have to grant on every invocation.