2 months ago
- The term 'sandbox' has been diluted to the point of being meaningless, often applied to Docker containers, browser tabs, or YAML policies that do not provide real isolation.
- A true sandbox collapses the trust problem from trusting the agent to trusting a verifiable specification, enforced by hardware-level microVM isolation.
- Seven properties define a genuine sandbox: hardware-enforced boundary, zero ambient authority, small auditable trusted computing base, reproducible image as specification, resource limits enforced under attack, no persistence without explicit declaration, and configuration cannot weaken isolation.
- Guardrails must run on the boundary (e.g., hypervisor) not inside the same kernel as the agent, otherwise they are merely suggestions an agent can bypass.
- The old cost argument against per-task VMs is obsolete; microVMs cold-start in milliseconds and can pack a million per server.
- The recommended strategy is to isolate first and recover utility through explicit grants, which fail loudly with evidence, rather than relaxing boundaries which fail silently.
- NOFire agents implement this definition: one microVM per task, no in-guest agent, scoped identity, egress allowlisting, hash-verified images, and per-step checkpoint/rollback.