Allow git commands in git worktrees #967

Activity

1. jonathan-conder commented on Aug 2, 2026

   

   jonathan-conder

   on Aug 2, 2026

   Contributor

   More actions

   There are some non-AI use cases for this, e.g. SDKcraft uses setuptools_scm which only works when the .git directory is available. I think it's possible to work around by mounting .git/ inside the container and bind-mounting a custom config file over the .git file in the worktree. But I haven't tested it. Most of the time I prefer running git on the host, so I can sign my commits, etc.

   For AI (or other untrusted code), it's not safe to expose .git/ read-write because it can use .git/hooks/ to escape the container. What I've been doing recently is creating a local clone and connecting to it over SSH, e.g.:

   $ git clone . ../myproject2
   $ workshop --project ../myproject2 launch
   $ git remote add myagent dev.myproject2.wp:/project

   That means the AI has its own copy of .git/, so it can see the history but can't mess with your primary copy of it. By connecting over SSH, pre-push and other hooks run inside the container rather than the host.

   At the moment SSHing into a workshop requires a bit of setup, but it should work "out of the box" in the next release.
2. marco6 commented on Aug 24, 2026

   

   marco6

   on Aug 24, 2026

   Author

   More actions

   Hi @jonathan-conder!

   sorry for the late reply, I was OOO.

   For AI (or other untrusted code), it's not safe to expose .git/ read-write because it can use .git/hooks/ to escape the container.

   While this is true, literally letting AI modify your code is 100% unsafe if that is mounted on your system as well. There are just so many ways with which AI can escape the container... For example by adding hooks to whatever packaging system you have. In rust for instance it is enough to have a package in the dependency chain that has a build.rs for AI to be able to write literally anything at the next cargo check (enough to have vscode open). Same goes with npm, same goes with python and literally any dev env.

   So, I don't think I would be adding a lot of security by doing hops as you propose. On the other side, I would lose a lot of nice interface and branch management from git worktrees.
3. jonathan-conder commented on Aug 24, 2026

   

   jonathan-conder

   on Aug 24, 2026

   Contributor

   More actions

   While this is true, literally letting AI modify your code is 100% unsafe if that is mounted on your system as well. There are just so many ways with which AI can escape the container... For example by adding hooks to whatever packaging system you have. In rust for instance it is enough to have a package in the dependency chain that has a build.rs for AI to be able to write literally anything at the next cargo check (enough to have vscode open). Same goes with npm, same goes with python and literally any dev env.

   These are all things that should be run inside the workshop. If you want to run them on the host, first you should review the code (but it's hard to do that if you can't run git commands safely).

   So, I don't think I would be adding a lot of security by doing hops as you propose. On the other side, I would lose a lot of nice interface and branch management from git worktrees.

   Yes it definitely feels like jumping through too many unnecessary hoops; I'm all ears if you have a nicer approach in mind.
4. jonathan-conder commented on Aug 25, 2026

   

   jonathan-conder

   on Aug 25, 2026

   Contributor

   More actions

   There's a git config option called worktree.useRelativePaths; this might make it easier to use worktrees inside a workshop. You'd still need to mount the main worktree somewhere though, and having /project/ so close to / is probably quite unhelpful
5. jonathan-conder commented on Aug 25, 2026

   

   jonathan-conder

   on Aug 25, 2026

   Contributor

   More actions

   It's a relatively recent feature but Ubuntu 26.04 has it; 24.04 doesn't. One approach would be to put your workshop files one level up, then /project inside the workshop will see all the worktrees.
6. jonathan-conder commented on Nov 3, 2026

   

   jonathan-conder

   on Nov 3, 2026

   Contributor

   More actions

   This one is now on our roadmap (i.e. supporting git commands against mounted worktrees)