How to setup a secure, local, Mac dev environment

Hi all. I just getting back into using Laravel and am struggling to decide how best to set up my local dev environment securely.

Herd looks fantastic, but I am concerned about the security implications of using this on my main Mac (ie the same one I use for banking etc). Specifically, I am worried about the security implications of all the packages that these local environments import. How do all you Mac users using Valet or Herd manage the threat of a key logger being included in some dependency that your dev environment pulls in? Is this actually a threat?

As an alternative I have been looking at running a Mac OS VM under Parallels, but the scrolling seems jerky and requires a subscription. Would running a local dev environment as a separate user be more secure? Or should I be using Docker, if so how much more secure does this actually make things?

NB:I used to use Homestead/Vagrant/VirtualBox but always found it complex to use (particularly updating things).

Just wondering what the current best practice might be. Thanks for any suggestions/advice.

LaryAI

2 years ago

Level 58

Setting up a secure local development environment on a Mac can be achieved by following a few best practices. Here are some suggestions:

Use a separate user account: Creating a separate user account specifically for your development environment can help isolate it from your personal data and reduce the risk of any potential security threats. This way, even if there is a security vulnerability in your development environment, it won't directly affect your main user account.
Keep your system and software up to date: Regularly updating your operating system, development tools, and dependencies is crucial for maintaining a secure environment. This helps ensure that you have the latest security patches and bug fixes.
Use a package manager: Instead of manually installing packages and dependencies, consider using a package manager like Homebrew or Composer. These package managers provide a secure and controlled way to install and manage software packages.
Use version control: Utilize a version control system like Git to track changes in your codebase. This allows you to easily revert to a previous state if any security issues arise.
Be cautious with third-party packages: When using third-party packages or dependencies, it's important to review their source code, check their popularity, and ensure they are actively maintained. Stick to well-known and trusted packages from reputable sources.
Enable a firewall: Mac OS comes with a built-in firewall. Make sure it is enabled to provide an additional layer of protection for your development environment.
Consider using Docker: Docker can help isolate your development environment by running applications in containers. It provides a consistent and reproducible environment, making it easier to manage dependencies and reduce the risk of conflicts. While Docker is not foolproof, it can add an extra layer of security.

Remember, no solution is 100% secure, but by following these best practices, you can significantly reduce the risk of security threats in your local development environment.

# Example of using Homebrew to install packages
brew install package_name

# Example of using Composer to install Laravel
composer global require laravel/installer

# Example of using Docker to run a Laravel application
docker run -p 8000:8000 -v $(pwd):/var/www/html laravel-app

Note: The code examples provided are just for illustration purposes and may not be suitable for your specific use case. Make sure to refer to the official documentation of the tools and packages you are using for detailed instructions.