And how are you going to define what ocaps/flows are needed when agent behavior is not defined?

Yes please! I feel like we need filters for everything: file reading, network ingress egress, etc Starting with simpler filters and then moving up the semantic ones…

So basically WAF, but smarter :)

Oof

> What happened to curing cancer?

Because being a cancer is more, well, metastasizing.

Remember, that capitalism is growth at all costs, until the host is dead, aka cancer.

And, fake money until you can be money?

+1. It is confusing.

First thing I heard about it too, apparently docker has VMs now?

> Each agent runs inside a dedicated microVM with a version of your development environment and only your project workspace mounted in. Agents can install packages, modify configs, and run Docker. Your host stays untouched. - https://www.docker.com/products/docker-sandboxes/

I'd assume they were just "more secure containers" but seems like something else, that can in itself start it's own containers?

Docker Sandboxes are microVMs.

Basically due to many reasons, ld_preload, various containers standards, open desktop, current init systems, widespread behavior from containers images from projects, LSM limitations etc…

It is impossible to maintain isolation within an agentic environment, specifically within a specific UID, so the only real option is to leverage the isolation of a VM.

I was going to release a PoC related to bwrap/containers etc… but realized even with disclosure it wasn’t going to be fixed.

Makes me feel bad, but namespaces were never a security feature, and the tooling has suffered from various parties making locally optimal decisions and no mediation through a third party to drive the ecosystem as a whole.

If you are going to implement isolation for agents, I highly suggest you consider micro VMs.