#sandboxing
Wiki 15
- Adding Golang to a browser code runner GOOS=js hangs inside a V8 isolate; GOOS=wasip1 plus a 50-line WASI shim runs Yaegi instead
- BubbleWrap your dev env and agents Ciężarkiewicz's Bubblewrap-based isolation for LLM agents, with Nix and tmux integration
- Dropping Privileges in Go A Go program self-restricting at startup — chroot, setrlimit, pledge/unveil, seccomp, Landlock — via x/sys/unix
- Hardening container images Mike Cardwell rebuilds the PowerDNS Recursor image as two static binaries on scratch, with Landlock, seccomp, daily rebuilds, SBOM, VEX and cosign
- Matryoshka Isolation (Containers Inside VMs) The defense-in-depth pattern where each isolation layer trusts only the layer below — host kernel, VMM, guest kernel, container runtime, untrusted code
- MicroVM A virtual machine pared down to the minimum needed to run a single workload — small VMM, few emulated devices, fast boot, hardware-isolated kernel
- Privilege Dropping Least privilege applied at startup — acquire resources, then irreversibly shed capabilities so a later compromise is contained
- Rewriting Every Syscall in a Linux Binary at Load Time Binary rewriting technique that replaces syscall instructions with INT3 traps for complete process isolation
- Rivet Blog rivet.dev — engineering writeups from the team behind the Sandbox Agent SDK, focused on agent sandboxing and microVM infrastructure
- Sandboxing AI Agents Taxonomy of approaches for constraining what an AI coding agent can do — OS isolation, network policy, syscall filtering, HTTP interception
- Spindle — QEMU microVM CI engine for Tangled Tangled's self-hostable CI runner gains a QEMU-microVM engine — per-workflow VMs, NixOS-from-YAML config, a vsock guest agent, and two-way Nix caching
- VMs Won't Contain Cyber-Capable Agents A Trail of Bits researcher gave GPT 5.6-Cyber a VM-escape CTF; it broke out three times, using disclosed bugs, an unpatched Debian library, and its own 0-days
- We Reverse-Engineered Docker Sandbox's Undocumented MicroVM API Rivet's writeup of the undocumented `/vm` HTTP API in Docker's sandboxd daemon, what it gives you, and the Sandbox Agent SDK they built on top
- WebAssembly Portable, sandboxed compilation target: core spec, interpreter vs AOT runtimes, wasm2js fallback
- Your Container Is Not a Sandbox — MicroVM Isolation in 2026 Emir Beganović's KubeCon-EU-2026 readout on the microVM ecosystem and why agentic AI is becoming microVMs' "Docker moment"
Toolbox 8
- hazmat macOS containment for AI coding agents via a separate Unix user, Seatbelt sandbox and pf rules
- pullrun Runs one OCI image as a runc container, a Firecracker microVM, or an Apple Silicon VM off a content-addressed DAG store
- pve-microvm Debian package that adds sub-second-booting QEMU microvm guests to Proxmox VE
- Sandbox Agent SDK TypeScript SDK for running coding agents inside Docker's microVM sandboxes under one interface
- superhq macOS app running coding agents in microVMs, with credentials injected host-side, never in the VM
- Wanix Plan 9-style per-process namespaces in the browser — run Wasm and x86 programs sandboxed, no server
- Wasmer WebAssembly runtime in Rust with swappable compiler backends and the WASIX system interface
- wazero WebAssembly runtime in pure Go with no CGO, so embedding it keeps cross-compilation free