I think some form of isolation is non-negotiable when you're running model-generated code. Things like process isolation, filesystem restrictions, network controls etc. make complete sense. What I'm less sure about is whether VM-based approaches are necessary as often as people seem to think.
In my experience using coding agents locally, basic guardrails and sensible restrictions have been enough most of the time, at least when I'm operating in a relatively controlled environment and not deliberately pushing the agent into risky situations. Of course, that's very different from a production service running arbitrary user code.
So I'm curious: - What are you using to sandbox agents today? - What threat model are you optimizing for? - Have you had incidents that convinced you VM-level isolation was necessary? - Where do you draw the line between "good enough" and "needs stronger isolation"?
Would love to hear what has worked (or not worked) for others.
cpburns2009•49m ago
The threat model I'm concerned about is supply chain attacks on third-party package repositories. The primary goal is to keep the convenience of containers, but to limit the blast radius of a compromised package or application, and reduce the risk of container escape. The software stack I'm currently evaluating is:
- Kata Containers: Backend for containerd to run each container in a KVM-backed QEMU microVM (alternative to the standard runc).
- containerd: Container runtime. Docker and Podman are not compatible with Kata 3. Kata 4 is supposed to fix that.
- nerdctl: Docker-compatible front-end to containerd.
- cni-plugins: networking component for containerd. Used to isolate containers networks.
- iron-proxy: MitM, TLS-intercepting egress proxy. This restricts all outbound traffic to whitelisted domains and IPs, and supports secret injection. Squid is a more established alternative.
How is this used in practice? I have a small bash script to launch the sandboxed OpenCode container with the current folder bind-mounted. OpenCode only has file-system access to the context directory, and limited network/internet access.