Sandboxing Agent Code
Run code an agent writes without trusting it: isolation levels from process sandboxes to gVisor and microVMs, a locked-down container, egress through a proxy, secrets kept outside, resource limits and managed sandbox defaults.
Last updated
After this section you can
- Choose an isolation level (process sandbox, container, gVisor, microVM) for a given threat
- Lock down a container for untrusted code, and route its egress through a proxy that holds the secrets
- Spot the gaps in a sandbox design: open defaults, DNS, the metadata address, leaked timeouts
Running Agent-Written Code Safely: Sandboxes, Egress and Secrets
An agent that writes code and runs it is running code from a stranger: whoever wrote the web page, README or package it just read. The sandbox has to hold even when the model has been fooled.
Assume the code is hostile and design so that does not matter. It gets compute and a scratch disk, and nothing else: no network except a proxy you control, no secret it can read, hard caps on CPU, memory, processes and time, and a fresh box per run or tenant. How strong the wall must be depends on who wrote the code and who else shares the host.