nono

Think the strongest product nth space is https://github.com/nolabs-ai/nono for what it's worth. Plus it is a priority for that team so if you are having issues the no labs guys will likely fix it :)

I am also curious if the new generations of sandboxing tech would change anything. Something like https://github.com/nolabs-ai/nono

We have taken to letting our agents use specific CLIs directly and we narrow down their access control with nono tool sandboxing via a customized Pi agent running headless. We have one agent that can use the aws CLI and nono feeds in a phantom SigV4 credential and then policy limits to just read-only http methods and certain L7 filtering on paths to limit its abilities - this means we can have it monitor and debug deployment failures without it doing any damage. It was all largely based off this example https://github.com/nolabs-ai/nono/tree/main/tool-sandbox-exa...

I've been satisfied with using Pi inside of srt [0]. I launch with `srt pi` and get file system and network isolation. There is a seemingly infinite risk surface area to protect, but I think does a reasonable job of balancing security and convenience. I've also heard good things about nono [1] from colleagues, but I haven't personally tried it out yet. [0] https://github.com/anthropic-experimental/sandbox-runtime [1] https://github.com/nolabs-ai/nono

Git worktrees are a great isolation boundary for _changes_ (especially making changes in parallel on a single machine), but not behavior. If you are trying to actually run autonomous agents securely you need something that lives outside the harness that actually blocks actions in a way that can't be prompted around. We use nono [1] for this internally, essentially blocking any actions we don't want agents to be able to do without human approval. Our developers can just run `task claude` or whatever their harness is) and it pre-wraps it with our profile that enforces: - Filesystem: read/write only the worktree plus dev-tooling dirs (Go, Doppler, Graphite caches, git common dir); explicitly no Docker socket and it can't edit its own Claude settings files (so it can't loosen its own permissions). - Network: outbound only to an allowlist - An

Looks similar to https://github.com/nolabs-ai/nono. Maybe one day you can fill out https://github.com/LuD1161/agentjail/issues/10 with a comparison to that project too.

If you don't want to do that, don't use a VM. I like nono: https://github.com/always-further/nono

There are a number of utilities for this. I use jai: https://jai.scs.stanford.edu/ but also have seen nono: https://github.com/always-further/nono smolvm: https://github.com/smol-machines/smolvm zerobox https://github.com/afshinm/zerobox and matchlock https://github.com/jingkaihe/matchlock They all have pros and cons. Pick the one that suits you best. Then you're also agent harness flexible (I use opencode).

I'm currently using herde[1] to handle/supervise multiple agents (with some patches I need to try to upstream) along with Nono[2] for sandboxing. This sandboxing approach avoids use of a microVM, which lets me use tooling I already have installed inside the sandbox. The downside is getting all the policies correct as it seems every project needs some new type of access, though Nono does try to make policy writing easy. I've been considering switching my approach to using a microVM through microsandbox[3]. The pro of this approach is you can essentially skip the policies and rely on the security of the VM boundary. The negative is that now you've lost all your installed tools, so you need to either provision at runtime or build something (like an image) beforehand to match your dev environment. I still don't know which is less maintenance.

This nono? https://github.com/always-further/nono > Just remember to disable CC’s auto-updater if that’s what you’re using. Why?

Hey HN. I'm Luke, security engineer and creator of Sigstore and other open source security projects. I've been building nono, an open source sandbox for AI coding agents that uses kernel-level enforcement (Landlock/Seatbelt) to restrict what agents can do on your machine. One thing that's been bugging me: we give agents our API keys as environment variables, and a single prompt injection can exfiltrate them via env, /proc/PID/environ, or just an outbound HTTP call. The blast radius is the full scope of that key. So we built what we're calling the "phantom token pattern" — a credential injection proxy that sits outside the sandbox. The agent never sees real credentials. It gets a per-session token that only works only with the session bound localhost proxy. The proxy validates the token (constant-time), strips it, injects the real credenti

I've been collecting a list of sandboxing related projects as well, some lower level than others. I wish I had time to evaluate them all: - https://github.com/jingkaihe/matchlock - https://github.com/mishushakov/libkrun-go - https://github.com/earendil-works/gondolin - https://github.com/butter-dot-dev/bvisor - https://github.com/amlalabs/amla-sandbox - https://github.com/eryx-org/eryx - https://github.com/containers/bubblewrap (not new) - https://github.com/coplane/localsandbox - https://github.com/sd2k/conch - https://github.com/Gerharddc/litterbox - https://github.com/finbarr/yolobox - https://github.com/coventry/sandbox-codex - https://github.com/osks/ctenv - https://github.com/tianon/gosu - https://github.com/colony-2/shai - https://github.com/rcarmo/agentbox - https://github.com/coder/httpjail - https://github.com/bytecodealliance/c