Birbla

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • To everyone sharing their favorite container-based sandboxing solution: Docker Sandbox does not use containers for isolation. It spawns the workload in a libkrun-based micro VM, which has vastly different security properties.
    by codethief
  • Do you mean like Podman has supported for years…?

    eg: https://josecastillolema.github.io/podman-wasm-libkrun/#libk...

    by akdev1l
  • The other day I saw this: https://nono.sh/

    Haven't tested it yet, but it seems to address the same issue as Docker Sandboxes, but in a different way.

    by dethos
  • I have tested it and the big advantage is that is has access to the local development tools.

    But it’s not as well sandboxed for sure.

    by speedgoose
  • I just made my own devcontainer that I copy on any project and load whatever harness I want in that repo. Harnesss' config and auth are simply mounted from the host, so no setup required at all.

    https://github.com/iodize6399/ai-devcontainer/tree/main/.dev...

    by navigate8310
  • yeah, I actually just re-use claude-code .devcontainer: https://github.com/anthropics/claude-code/tree/main/.devcont...

    I especially like the firewall it has.

    by cvak
  • Yeah I also recently started using devcontainers for this

    I quite like the 'features' layer system, adding extra tools to container in a declarative plugin-like way

    Being able to 'safely' run with skip permissions has been a gamechanger

    by anentropic
  • I built "Locki": something similar but open-source! A bit different approach -- single VM with Incus containers -- focusing on speed of spinning up new sandboxes and integraton with git worktrees. The core grievance that motivated me was the lack of docker/kubernetes support in existing sandboxing tools, with Locki there's no chance of footguns like "two agents rebuild :latest tag at the same time". Give it a try: https://github.com/JanPokorny/locki
    by PufPufPuf
  • Looks cool!

    I took a similar approach with https://runmachine.dev/ but later switched to OrbStack for iOS development.

    by katspaugh
  • Apple Container is an interesting work in progress: https://github.com/apple/container
    by benguild
  • I am developing a project that makes running in Apple Container (Docker is an alternate runtime for Linux) more convenient: https://github.com/gregwebs/claude-contained/

    It blocks network access by default, mounts only what you specify, and you can add a customization layer. This is all done in the container itself (srt for network blocking). It doesn't implement a central point for secret sharing, MCP exposure, etc. So it might not have enough features for some but it works well for my needs.

    I just found through this thread yoloai which has an apple container backend, so its quite similar using that. My main issue would be that network access is allowed by default. https://github.com/kstenerud/yoloai

    Several other projects listed here use libkrun which is an alternate implementation that works with Mac's HVF. smolvm, microsandbox, podman (with likrun backend), gondolin.

    by gregwebs
  • I got excited for this not because this didn't exist before, but because Docker putting their weight on this would imply a broader adoption and better integration in the industry. I am sad that they are asking for a login here though, which doesn't make any sense to me.
    by karakanb
  • microVMs (firecracker) have existed for years. This is not new.
    by rvz
  • That's docker, man. Tomorrow they're gonna add limits on sandbox runs without a premium account too
    by KolibriFly
  • Wow, I hope one day Linux will be able to support the exclusive MacOs/Windows technology of Docker Sandboxes.

    (it's in the doc, but kinda strange to not see some instructions on the main page, probably distro related)

    by hokkos
  • Whoah. I took for granted it'd work on Linux.
    by ethagnawl
  • What about bubblewrap? It also provides a sandbox
    by stefanka
  • There's always https://github.com/mensfeld/code-on-incus
    by crabmusket
  • What is the main benefit over doing something like:

        docker run --runtime krun --rm -it -v $(pwd):/workspace/$(basename $(pwd)) -w /workspace/$(basename $(pwd)) --network restricted-net ghcr.io/openai/codex-universal:latest sh
    That runs the codex OCI in a qemu microvm. From what I can see, more fine grained network and filesystem access control as well as convenience?
    by sureglymop
  • Yes, pretty much, except for one detail:

    > That runs the codex OCI in a qemu microvm.

    AFAIU it's actually the other way around: krun spawns a libkrun-based (not QEMU-based) VM inside a crun container. Source: https://github.com/libkrun/libkrun/discussions/538#discussio...

    So with your solution you get the additional security benefit of containerizing the hypervisor on the host.

    by codethief
  • The credentials part...

    https://docs.docker.com/ai/sandboxes/security/credentials/

    by defraxi
  • Aside from hiding agent credentials from the agent, it also runs an isolated Docker Engine for the agent to use freely.
    by mdavidn
  • How about implementing proper permissions on the tool use or if you need more flexibility a dedicated model to analyse potential impact? (Like Claude Code's Autopilot but more configurable)?

    I find solutions like this to be a like trying to patch a leaking boat on a lake with duct tape. It will help, but it's not a proper solution.

    Also, often the tasks you want the AI to perform are in the outside world. Like "connect to my servers, and figure out X and Y".

    The proper way is permission isolation. I run a small k8 cluster in the homelab and I have 3 types of pod/agent combinations for my AI agents. Read only, one that can change my gitops but it needs to create PRs that admin approves, and admin.

    Likewise with code. I have a forgejo git instance where agents have ability to create feature branches and so on, but merging is gated.

    Those things require "GH enterprise features".

    In fact more and more things we do at home will require "enterprise features". Why? Because a person with AI is basically a small team, but some of team members behave like Chimps on crack... So security must be top notch.

    by Roark66
  • yea...I think k8s is de wae for running proper proper rbac sandboxes for agents.
    by victor_edka
  • Implementing that is trivial in the harness side. You code vibe that in minutes.
    by iury-sza
  • What are the proper permissions for an agent? An agent shouldn't be able to read ~/.ssh, but that means a bash tool that spawns `cat` is different than one that spawns an ssh client. I don't allow my agents to use git commit, except sometimes I ask an agent to split up a complicated branch that I can't be bothered to split myself. rm'ing intermediary files is fine, but rm'ing committed files is bad, unless the agent has done *.bak renaming and is cleaning up itself, etc.

    I don't think "proper" permissions are possible without dramatically limiting the way people use these tools.

    by AlotOfReading
  • > Each agent runs inside a dedicated microVM with your dev environment

    What's a "microVM" and what's the security model here compared to using real virtual machines with actual constraints on breakouts?

    Is it marketing fluff?

    Incus/LXD has had VM's for a long time now.

        incus launch images:ubuntu/26.04 my-ubuntu-vm --vm
    incus exec my-ubuntu-vm -- bash
    by Grimburger
  • That's a full VM. Microvms are much smaller and they start up very very fast. In miliseconds.
    by dizhn
  • Your example is not complete, you have to show how it will run claude/codex, you have to do extra things to install run and mount folders there, this one does that with less config, also with this agents can run docker, lxd doesn't allow you to do that
    by vdfs
  • It’s real VMs, firecracker style.
    by frio