Terminal Fury
Ribbit. Froggy has one question.
Why...
is your build environment...
still alive?
Why does it have a home directory?
Why does it remember Tuesday?
Why does it know who you are?
You run the build on your laptop.
Same laptop with SSH keys,
cloud credentials,
Git tokens, browser sessions,
Docker sockets, and five AI agents
you told to “just get it working.”
Ribbit. This is not isolation.
This is a petting zoo with root access.
Froggy counts the risks.
One. Credential theft. Two.
SSH key exposure. Three.
Cloud-token leakage. Four. Supply-chain compromise.
Five. Malicious install scripts.
Six. Poisoned caches.
Seven. Cross-project contamination.
Eight.
Persistent malware. Nine. Secrets in environment variables.
Ten. Secrets in logs.
Eleven. Docker socket access.
Twelve. Privilege escalation. And your coding agent finding ~/.aws and thinking: “Oh!
Useful context!”
NO. RIBBIT.
BUILD IT.
RUN IT.
TEST IT. KILL IT.
BUILD IT. RUN IT.
TEST IT. KILL IT.
Ephemeral. Disposable. Reproducible. Replaceable.
Nothing remembered. Nothing trusted.
Nothing survives.
Developer
one has Node 24.
Developer two has Node 22.
Developer three says: “It works locally.” Someone installed a global package in
February. Nobody remembers why.
Delete it? Build breaks.
Excellent. You have invented environmental archaeology.
Persistent environments accumulate state.
State becomes assumption. Assumption becomes dependency.
Dependency becomes folklore. Eventually somebody says: “Don't delete that directory.” Nobody knows
what it does.
Froggy calls this a haunted server.
“But Froggy... containers aren't a security boundary.”
Correct. Ribbit. Use the boundary appropriate to the threat model.
Container. Sandbox. MicroVM. Disposable VM.
Remote runner. The technology can change.
The principle does not.
A build gets exactly what it needs,
for exactly as long as it needs it.
Then it dies. NO PERSISTENT CREDENTIALS.
NO SHARED HOME DIRECTORY.
NO MYSTERY FILESYSTEM STATE.
NO ANCIENT CACHE. NO BUILD SCRIPT READING YOUR WORKSTATION.
NO AGENT WITH: ROOT.
DOCKER.
AWS. GITHUB. KUBECONFIG. SSH.
YOUR HOME DIRECTORY. BECAUSE SOMEBODY SAID: “IT'S ONLY DEV.” BUILD IT!
RUN IT! TEST IT!
KILL IT!
SHORT-LIVED CREDENTIALS! EXPLICIT MOUNTS!
PINNED TOOLCHAINS!
CLEAN FILESYSTEM!
NOTHING SURVIVES!
Clean environments make failures meaningful.
They expose undeclared dependencies.
If rebuilding the environment changes the result— your build was never reproducible.
Create. Execute. Destroy.
Not:
Create.
Execute.
Keep forever.
Install twelve more things.
Give an AI root.
Hope.
Ribbit.