landrun

On Linux, we rely on a chroot-ed workspace at this time - although we are working on a prototype using the new landlock kernel interface (https://github.com/Zouuup/landrun). OSX is the best, we use the in-built (seatbelt) sandbox via sandbox-exec. For Windows, we use WSL containers when available. By default, if a safe sandbox environment is not available, we inform the user that a repro is not possible in the current conditions.

Isn't landrun the preferred way to sandbox apps on linux these days instead? https://github.com/Zouuup/landrun

I recently had a question about what AI sandboxes use and I think Modal uses gvisor under the hood and I think others use firecracker/generally favour it as well Firecracker kind of ends up being in the VM categories and I would place gvisor in a similar category too under the VM So in my opinion, VM's are sandboxes. Of course there is also libriscv https://github.com/libriscv/libriscv which is a sandbox (The fastest RISC-V sandbox) There is also https://github.com/Zouuup/landrun Run any Linux process in a secure, unprivileged sandbox using Landlock. Think firejail, but lightweight, user-friendly, and baked into the kernel. Your mileage may vary but I consider firecracker to be the AI sandbox usually. Othertimes it can be that they abstract on a cloud provider and open up servers in that or similar (I feel E2B does this on top of gcp)

https://man.freebsd.org/cgi/man.cgi?jail https://github.com/Zouuup/landrun

Yup. There are tools that use landlock to accomplish just that. https://github.com/Zouuup/landrun All you gotta do is apply a policy and do a fork() exec(). There is also support in firejail.

That's the entire point of sandboxing, so none of what you listed would be accessible by default. Check out https://github.com/anthropic-experimental/sandbox-runtime and https://github.com/Zouuup/landrun as examples on how you could restrict agents for example.

I am not exactly sure about using containers (most likely you mean docker/podman) as sandboxes... Please correct me wrong but for a better form of sandboxing, I would recommend something like microvm and the bottlefire thing which was recently shared if that might pique your interest as I found it to be interesting and then using it with something like https://github.com/Zouuup/landrun There is also tinykvm and other projects too which can simply take a binary and run it and I think that maybe developers should also try out all the different sandboxes and different things just for understanding as well I suppose too. To me, I really like playing with different form of sandboxes or such technologies in general. Also do note that I am not sure if bottlefire provides sandbox/isolation by default as they mention Sandbox with Landlock seperate