# Building a Secure Infinito.Nexus AI Development Environment on Linux

**URL:** https://hub.infinito.nexus/t/building-a-secure-infinito-nexus-ai-development-environment-on-linux/548
**Category:** AI
**Created:** [May 27, 2026, 12:51pm UTC](https://hub.infinito.nexus/t/building-a-secure-infinito-nexus-ai-development-environment-on-linux/548 "2026-05-27T12:51:10Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![kevinveenbirkenbach](https://hub.infinito.nexus/user_avatar/hub.infinito.nexus/kevinveenbirkenbach/32/7_2.png) [@kevinveenbirkenbach](https://hub.infinito.nexus/u/kevinveenbirkenbach)
#### Post date: [May 27, 2026, 12:51pm UTC](https://hub.infinito.nexus/t/building-a-secure-infinito-nexus-ai-development-environment-on-linux/548/1 "2026-05-27T12:51:10Z")

</div>

AI coding agents like Claude Code, OpenAI Codex, and Gemini CLI are transforming software development. They can:

- edit files autonomously
- execute shell commands
- refactor projects
- install dependencies
- generate infrastructure code
- manage workflows across repositories

That power also creates a major security risk.

If you run these agents directly on your host operating system, a bad prompt, hallucinated command, broken plugin, or compromised dependency can quickly damage your system.

This guide explains how to build a **secure AI development environment** for Infinito.Nexus using:

- a dedicated Linux VM
- Code OSS
- Claude Code
- OpenAI Codex
- Gemini integrations
- isolated AI tooling
- Git-based safety workflows

The goal is simple:

> Never run autonomous AI agents directly on your production workstation or host operating system.

* * *

# Why You Should Always Use a VM

AI coding agents are not simple chatbots anymore.

Modern agents can:

- recursively edit files
- execute bash commands
- install packages
- modify Docker containers
- rewrite configurations
- delete directories
- access secrets accidentally
- perform autonomous multi-step workflows

Even with safety systems, mistakes happen.

Infinito.Nexus itself includes explicit AI-agent governance documentation through:

```plaintext
AGENTS.md
CLAUDE.md
GEMINI.md

```

These files define:

- sandbox behavior
- permission boundaries
- allowed commands
- restricted operations
- workflow conventions

([github.com](https://github.com/infinito-nexus/core/blob/main/GEMINI.md?utm_source=chatgpt.com)) ([GitHub](https://github.com/infinito-nexus/core/blob/main/GEMINI.md?utm_source=chatgpt.com "core/GEMINI.md at main · infinito-nexus/core · GitHub"))

The safest setup is therefore:

```plaintext
Host Operating System
└── Virtual Machine
    ├── Linux
    ├── Code OSS
    ├── AI Agents
    ├── Docker
    └── Infinito.Nexus Development Environment

```

If an agent breaks the VM:

- your host remains safe
- secrets stay isolated
- snapshots allow instant rollback
- experiments remain disposable

* * *

# Recommended Linux Distributions

Any modern Linux distribution works well.

Recommended choices:

| Distribution | Why It Works Well |
| --- | --- |
| Fedora Workstation | Excellent developer experience |
| Ubuntu LTS | Large ecosystem and tutorials |
| Debian | Stable and predictable |
| Arch Linux | Cutting-edge tooling |
| CentOS Stream | Enterprise-oriented workflows |

For most users:

- Fedora Workstation
- Ubuntu 24.04 LTS

are the best choices.

* * *

# Recommended Virtualization Platforms

Use one of the following:

| Platform | Notes |
| --- | --- |
| KVM/QEMU | Best native Linux performance |
| VirtualBox | Easy cross-platform usage |
| VMware Workstation | Stable enterprise solution |
| GNOME Boxes | Beginner friendly |
| Proxmox | Excellent for dedicated lab environments |

Recommended VM resources:

| Resource | Recommendation |
| --- | --- |
| RAM | 16 GB |
| CPU | 4+ cores |
| Disk | 100 GB SSD |
| Network | NAT |

* * *

# Install Base Development Dependencies

Inside the VM install the required tooling.

## Fedora

```bash
sudo dnf install -y \
    git \
    make \
    curl \
    wget \
    nodejs \
    npm \
    python3 \
    python3-pip \
    docker \
    docker-compose \
    ansible

```

## Ubuntu / Debian

```bash
sudo apt update

sudo apt install -y \
    git \
    make \
    curl \
    wget \
    nodejs \
    npm \
    python3 \
    python3-pip \
    docker.io \
    docker-compose \
    ansible

```

Enable Docker:

```bash
sudo systemctl enable --now docker
sudo usermod -aG docker $USER

```

Relogin afterwards.

* * *

# Install Code OSS

Code OSS is the open-source foundation of Visual Studio Code.

## Fedora

```bash
sudo dnf install code

```

## Ubuntu / Debian

```bash
sudo snap install code --classic

```

Alternative distributions:

- VSCodium
- official VSCode packages

Downloads:

- [https://code.visualstudio.com/](https://code.visualstudio.com/)
- [https://vscodium.com/](https://vscodium.com/)

* * *

# Clone Infinito.Nexus Core

Clone the repository:

```bash
git clone https://github.com/infinito-nexus/core.git

```

Enter the repository:

```bash
cd core

```

Repository:

```plaintext
https://github.com/infinito-nexus/core

```

* * *

# Setup the Environment

The project uses `make` for environment automation.

Initial setup:

```bash
make

```

Useful commands:

```bash
make help
make install
make setup
make lint
make test

```

The Infinito.Nexus ecosystem heavily relies on:

- Docker
- Linux
- Ansible
- modular automation
- ActivityPub
- LDAP-based IAM
- Keycloak SSO

([github.com](https://github.com/infinito-nexus/core/blob/main/GEMINI.md?utm_source=chatgpt.com)) ([GitHub](https://github.com/infinito-nexus/core/blob/main/GEMINI.md?utm_source=chatgpt.com "core/GEMINI.md at main · infinito-nexus/core · GitHub"))

* * *

# Understanding AI Agent Configuration Files

Modern AI coding tools automatically load repository instructions from markdown configuration files.

Important standards:

| File | Used By |
| --- | --- |
| `AGENTS.md` | Codex, Cursor, Claude, others |
| `CLAUDE.md` | Claude Code |
| `GEMINI.md` | Gemini CLI |
| `.github/copilot-instructions.md` | GitHub Copilot |
| `.cursorrules` | Cursor |

The industry is increasingly converging around `AGENTS.md` as the universal standard. ([Agents](https://agents.md/?utm_source=chatgpt.com "AGENTS.md"))

These files define:

- project structure
- coding conventions
- safety rules
- testing workflows
- forbidden actions
- command usage

Before working with AI agents:

```bash
cat AGENTS.md

```

You should always understand:

- what the agent may execute
- what it may modify
- where secrets must never be exposed
- how sandboxing behaves

* * *

# Installing Claude Code

Install Claude Code globally:

```bash
npm install -g @anthropic-ai/claude-code

```

Launch:

```bash
claude

```

Claude Code automatically reads:

```plaintext
CLAUDE.md
AGENTS.md

```

depending on repository configuration. ([DeployHQ](https://www.deployhq.com/blog/ai-coding-config-files-guide?utm_source=chatgpt.com "CLAUDE.md, AGENTS.md & Copilot Instructions: Configure Every AI Coding ..."))

* * *

# Installing OpenAI Codex

Install Codex:

```bash
npm install -g @openai/codex

```

Or:

```bash
curl -fsSL https://chatgpt.com/codex/install.sh | sh

```

Run:

```bash
codex

```

Codex primarily reads:

```plaintext
AGENTS.md

```

and supports hierarchical agent configuration. ([DeployHQ](https://www.deployhq.com/blog/ai-coding-config-files-guide?utm_source=chatgpt.com "CLAUDE.md, AGENTS.md & Copilot Instructions: Configure Every AI Coding ..."))

* * *

# Installing Gemini CLI

Install Gemini tooling:

```bash
npm install -g @google/gemini-cli

```

Run:

```bash
gemini

```

Gemini automatically reads:

```plaintext
GEMINI.md

```

within the repository. ([DeployHQ](https://www.deployhq.com/blog/ai-coding-config-files-guide?utm_source=chatgpt.com "CLAUDE.md, AGENTS.md & Copilot Instructions: Configure Every AI Coding ..."))

* * *

# Installing AI Agent Extensions in Code OSS

One of the most important steps is properly integrating AI agents into Code OSS.

Open the Extensions view:

```plaintext
Ctrl + Shift + X

```

or:

```plaintext
View → Extensions

```

* * *

# Install Claude Extensions

Search for:

```plaintext
Claude Code

```

Recommended extensions:

| Extension | Purpose |
| --- | --- |
| Claude Code | Claude agent integration |
| Anthropic Tools | Claude workflows and utilities |

After installation:

1. Open terminal
2. Authenticate:

```bash
claude login

```

1. Restart Code OSS

Claude extensions will automatically detect:

```plaintext
CLAUDE.md
AGENTS.md

```

inside the repository.

* * *

# Install OpenAI Codex Extensions

Search for:

```plaintext
Codex
OpenAI

```

Recommended extensions:

| Extension | Purpose |
| --- | --- |
| OpenAI Codex | Codex integration |
| OpenAI Tools | Chat and workflow tooling |

After installation:

1. Open terminal
2. Authenticate:

```bash
codex login

```

or configure:

```bash
export OPENAI_API_KEY=...

```

Codex automatically reads:

```plaintext
AGENTS.md

```

for repository guidance.

* * *

# Install Gemini Extensions

Search for:

```plaintext
Gemini
Google

```

Recommended extensions:

| Extension | Purpose |
| --- | --- |
| Gemini Code Assist | AI coding assistance |
| Gemini Chat | Gemini interaction panel |

After installation:

1. Sign in with Google
2. Restart Code OSS
3. Open the repository folder

Gemini automatically loads:

```plaintext
GEMINI.md

```

from the repository.

* * *

# Recommended Additional Extensions

Recommended developer extensions:

| Extension | Purpose |
| --- | --- |
| GitLens | Git visualization |
| Docker | Container tooling |
| YAML | YAML support |
| Python | Python tooling |
| Ansible | Ansible support |
| Markdown All In One | Better markdown editing |
| Error Lens | Inline diagnostics |

* * *

# Recommended AI Agent Workspace Layout

A good secure AI workspace looks like this:

```plaintext
~/workspace/
├── core/
├── projects/
├── sandbox/
├── experiments/
└── backups/

```

Never give agents unrestricted access to:

- your home directory
- SSH keys
- browser profiles
- host filesystem
- production secrets

* * *

# Secure Workflow Recommendations

## 1. Commit Frequently

AI agents can create massive changes very quickly.

Commit constantly:

```bash
git add .
git commit -m "checkpoint"

```

* * *

## 2. Snapshot the VM Frequently

Always create snapshots before:

- dependency upgrades
- autonomous refactors
- infrastructure changes
- large AI-generated migrations

* * *

## 3. Never Expose Secrets in Prompts

Never paste:

- passwords
- API keys
- production tokens
- SSH private keys

into AI chats or prompts.

* * *

## 4. Keep the Environment Disposable

Your environment should always be rebuildable.

A healthy AI workflow assumes:

```plaintext
destroy VM → recreate VM → continue working

```

* * *

## 5. Keep AI Agents Contained

Never allow unrestricted access to:

- host operating system
- mounted personal folders
- password stores
- production infrastructure

Treat AI agents like semi-autonomous infrastructure processes.

* * *

# Useful Infinito.Nexus Resources

## Repository

```plaintext
https://github.com/infinito-nexus/core

```

## AI Cheatsheet

```plaintext
https://s.infinito.nexus/cheatsheet

```

## Agent Documentation

```plaintext
AGENTS.md
CLAUDE.md
GEMINI.md

```

* * *

# Example Daily Workflow

Start VM:

```bash
virsh start infinito-dev

```

Open repository:

```bash
cd ~/workspace/core

```

Start Code OSS:

```bash
code .

```

Start Claude:

```bash
claude

```

Or Codex:

```bash
codex

```

Or Gemini:

```bash
gemini

```

Review all changes carefully:

```bash
git diff

```

Commit validated work:

```bash
git commit -am "validated AI agent changes"

```

* * *

# Final Thoughts

AI-assisted development is incredibly powerful, but secure isolation is now mandatory.

The safest setup combines:

- Linux VMs
- isolated development environments
- Code OSS
- Git workflows
- sandboxed AI agents
- disposable infrastructure

Infinito.Nexus already embraces structured AI governance using:

- `AGENTS.md`
- `CLAUDE.md`
- `GEMINI.md`

making it an excellent foundation for secure AI-assisted infrastructure engineering. ([GitHub](https://github.com/infinito-nexus/core/blob/main/GEMINI.md?utm_source=chatgpt.com "core/GEMINI.md at main · infinito-nexus/core · GitHub"))