Building an Agent Sandbox from Scratch in Python

Two years ago I built a container runtime in Python. That post ended with a list of what the runtime lacked: no user namespaces, no seccomp, no capability dropping. Back then the list was a footnote. Now coding agents run shell commands on my laptop, and the list is the whole job. This post finishes that list. I add six layers to the runtime, one at a time. After each layer I run the same set of attacks and record which ones still work. Some results surprised me, and one missing line of code reopened the whole host. A container isolates a process you trust. A sandbox contains a process you do not. What an agent gets wrong An agent does not need to be malicious to do damage. It runs commands it found in a README, a web page, or an issue comment. Any of those can carry instructions written by someone else. So I wrote down what a hostile command would try: Read a secret outside the project, such as ~/.aws/credentials. Write outside the project, such as a line appended to ~/.bashrc. Open…

Commenting on Bubbles has been removed. Why? If you want to talk about this post, write to the author, use the comments on their blog if it has them, or reply with a "RE:" post on your own blog. Suggestions? feedback@bubbles.town