Companion links for the talk Securing AI Agents on Kubernetes: Identity, Sandboxes, and MCP Tool Governance Code Europe 2026, Warsaw · Dr. Roland Huß, Red Hat
The one-sentence version: put the controls in the environment, not in the prompt, and start at the bottom, because everything above the sandbox is advisory if the sandbox leaks.
Questions from the session chat for "Spec-Driven Development: Making AI Coding Assistants Build What You Actually Want". Some were answered live, the rest afterwards. Names are omitted.
Questions are grouped by theme rather than by the order they arrived, because several people were circling the same thing from different directions.
After a spec is merged and the requirement changes, do we update the existing spec or create a new one?
| #!/usr/bin/env python3 | |
| """Manage a dev OpenShell environment built from source. | |
| Unified tool for gateway lifecycle, supervisor image builds, | |
| CLI symlinks, log management, and brew service coordination. | |
| """ | |
| import argparse | |
| import os | |
| import platform |
| #!/usr/bin/env bash | |
| # | |
| # voice-transcribe.sh - Local microphone-to-text transcription | |
| # | |
| # Captures audio from the default microphone using ffmpeg (avfoundation), | |
| # detects speech segments via energy-based VAD, and transcribes each | |
| # utterance with whisper-cli. Transcripts are printed to stdout and | |
| # optionally appended to a file. | |
| # | |
| # Dependencies: ffmpeg, whisper-cli (brew install ffmpeg whisper-cpp) |
| # GENERATED BY cc-deck.build --target openshell - DO NOT EDIT MANUALLY | |
| # Regenerate with: claude /cc-deck.build --target openshell | |
| FROM ghcr.io/nvidia/openshell-community/sandboxes/base:latest | |
| ARG TARGETARCH | |
| # Layer: System packages (Ubuntu 24.04, apt-get) | |
| # Pre-installed: git, node v22, npm, python3, curl, make, claude, gh, uv | |
| USER root |
| use InfluxDB; | |
| use Data::Dumper; | |
| use REST::Client; | |
| use strict; | |
| # Script for migrating data from an outdated InfluxDB to one of the | |
| # latsest version. | |
| # Developed for migrating from an InfluxDB 0.7.0 to a 1.8.3 version in one go | |
| # ------------------------------------------------------------------------ |
| FROM golang:1.13.10-buster AS builder | |
| ARG VERSION_RESTIC=v0.9.6 | |
| ARG VERSION_RCLONE=v1.51.0 | |
| WORKDIR /opt | |
| RUN apt-get update \ | |
| && apt-get install -y \ | |
| git \ |