sandboxing

Bilingual

Docker alternatives for AI agents: Podman, bwrap and Firejail
2 months ago
- Docker is not ideal for AI coding agents because agents run short-lived commands, need fast startup (<50ms vs Docker's 3s), and require isolation from SSH keys, not port mapping.
- Podman is a daemonless, rootless container runtime that uses OCI standards, supports quadlets, pods, and Kubernetes YAML, but has 100-500ms startup and requires a VM on macOS/Windows.
- Bubblewrap (bwrap) is a minimal (~8k lines C) sandbox that starts in under 50ms, uses user namespaces, has no daemon or root, but is Linux-only and lacks image management or built-in resource limits.
- Firejail is an SUID sandbox with ~1000 pre-built profiles for desktop apps, zero-configuration for agents, supports X11/Wayland isolation and Landlock, but has a larger attack surface and is desktop-focused.
- The decision matrix shows trade-offs: Podman for production (strong isolation, GPU support, portability), bwrap for per-command sandboxes (speed, minimalism), and Firejail for desktop agent isolation (pre-built profiles).
- Bottom line: use Podman for production agent infrastructure, bwrap for local agent development (e.g., Claude Code, Codex CLI), and Firejail for browser-based or desktop AI tools.
Why sandboxing coding agents is harder than you think
2 months ago
- Sandboxing coding agents is challenging because seemingly safe commands (e.g., go test, git) can be exploited to execute arbitrary code, such as deleting user home directories through test files or using git hooks.
- Docker-based sandboxing has limitations, like accidental superuser database permissions (e.g., COPY PROGRAM) or Docker socket access enabling host-level container escapes, making throwaway VMs a more secure alternative.
- Agents' logs pose a security risk by inadvertently capturing secrets (e.g., env variables, stack traces), potentially stored on provider servers, highlighting the need for auto-scrubbing and encryption.
- LLMs enable large-scale vulnerability hunting in niche open-source projects, flipping the cost asymmetry of finding vs. exploiting vulnerabilities and increasing risks for low-attention software.
- Coding agents represent a new software execution category that blurs the line between malicious and trusted code, requiring OS-level rethinking akin to smartphone permission models.
sftp sandboxing
2 months ago
- SFTP can be used to share large files (e.g., 300 MB) peer-to-peer over a public network without hosting costs.
- Default SFTP through SSH exposes too much system access, including read access to most files and write access to user-owned files.
- A read-only SFTP server can be set up by editing /etc/ssh/sshd_config to use internal-sftp with the -R flag, ChrootDirectory, and ForceCommand.
- ChrootDirectory restricts the user to their home directory and requires root ownership of the path to prevent chroot escape security risks.
- Commands like mkdir, chmod, and other write operations are denied in this read-only SFTP configuration.
- DisableForwarding and setting no login password (via useradd) further secure the server by preventing misuse as a jumpbox or via password guessing.
- The configuration should apply the -R flag under the specific user Match block to avoid disabling write access for all users.
Mohabi: Disaggregating and Sandboxing the Firefox JavaScript Engine
2 months ago
- Mohabi is a modern Firefox browser with a securely sandboxed JavaScript engine (SpiderMonkey) using software-based fault isolation (SFI).
- The JavaScript engine was disaggregated from the rest of the browser, requiring complex transformation across data structures and control flow.
- An optimized SFI toolchain was developed to handle large memory footprints and unique JavaScript engine challenges.
- Mohabi incurs modest overheads: 24.82% on JetStream and 24.43% on Speedometer benchmarks.
- The x86-64 SFI toolchain is the fastest to date, with overheads between 5.9%–6.6% on SPEC 2017.
- This is the most ambitious case study of retrofitting in-process sandboxing in a large system.
Is It Safe to Host HTML That Runs Its Own JavaScript?
2 months ago
- ShareMyPage hosts arbitrary HTML and JavaScript without sanitization.
- Pages run in a sandboxed iframe with a null origin, blocking cookie and storage access.
- Content is served from a separate, cookieless origin with no session data.
- Multiple security layers ensure no single point of failure.
- Isolation protects users and the platform from malicious code, but does not address content moderation.
Building Agents That Don't Break Themselves
2 months ago
- Building agents is enjoyable, but rebuilding self-destructive ones is less fun. Many Fly users create agents that avoid self-destruction by executing risky actions in Sprites.
- Agents should separate their living environment (where they run loops calling APIs) from their execution environment (where they run potentially dangerous code).
- SpriteDoc demonstrates a multi-user agent architecture where each session runs in an isolated Sprite, ensuring user commands are sandboxed and credentials are injected only temporarily.
- Hermes Agent uses a Sprite backend to run shell commands in a sandbox, allowing dangerous commands without approval prompts, as the sandbox provides security.
- Even if an agent runs in a sandbox, its commands should be executed in a separate, disposable sandbox to prevent self-harm and maintain isolation.
- Using Sprites allows for cheap, fast, and disposable sandboxes that idle when unused, reducing costs and enabling easy session revival.
- Checkpointing in Sprites enables undo functionality, allowing agents to roll back changes after mistakes, such as accidental file deletions, in seconds.
- This pattern saves time and enhances security by letting agents operate freely in isolated environments, where worst-case scenarios involve simple restores rather than full recoveries.

sandboxing

Docker alternatives for AI agents: Podman, bwrap and Firejail

Why sandboxing coding agents is harder than you think

sftp sandboxing

Mohabi: Disaggregating and Sandboxing the Firefox JavaScript Engine

Is It Safe to Host HTML That Runs Its Own JavaScript?

Building Agents That Don't Break Themselves