Docker Sandboxes – Disposable, isolated sandboxes for AI agents • Hacker News Board

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#271

Post by iury-sza » Mon, Aug 10, 2026, 2:24 PM UTC

Roark66 wrote: post #262

How about implementing proper permissions on the tool use or if you need more flexibility a dedicated model to analyse potential impact? (Like Claude Code's Autopilot but more configurable)? I find solutions like this to be a like trying to patch a leaking boat on a lake with duct tape. It will help, but it's not a proper solution. Also, often the tasks you want the AI to perform are in the outside world. Like "conne…

Implementing that is trivial in the harness side. You code vibe that in minutes.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#272

Post by skinfaxi » Mon, Aug 10, 2026, 2:25 PM UTC

llimllib wrote: post #260

skinfaxi wrote: post #253

Earlier quoted context omitted.

How would that work? You don't control github.com servers so your repo would never see the secret. edit: You may want to look into tokenizing proxies as the general application of this concept.

Your agent writes secret.txt with the placeholder, and the tokenizing proxy replaces it with the token, then the agent reads secret.txt

It only replaces the token in the HTTP header that is sent to the server. Whatever you wrote in your files isn't touched by the proxy.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#273

Post by mikedelfino » Mon, Aug 10, 2026, 2:28 PM UTC

Since everyone is sharing their setup, here’s my approach, just to give people an idea of how others are doing it, however impractical it might look: I run a full Linux VM (with a GUI) on my Linux host. I connect via virt-viewer to run Claude Desktop, as I’m not a fan of using the terminal for this.

The VM sits on its own libvirt network in a dedicated firewall zone, and specific directories are shared via filesystem passthrough. To keep the agent from accessing anything related to Git, the actual gitdir is stored on a separate path outside the mount point.

I review the git diff manually and commit it from the host.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#274

Post by drdexebtjl » Mon, Aug 10, 2026, 2:29 PM UTC

llimllib wrote: post #260

skinfaxi wrote: post #253

Earlier quoted context omitted.

How would that work? You don't control github.com servers so your repo would never see the secret. edit: You may want to look into tokenizing proxies as the general application of this concept.

Your agent writes secret.txt with the placeholder, and the tokenizing proxy replaces it with the token, then the agent reads secret.txt

Maybe the tokenizing proxy could work both ways? If the agent tries to read secret.txt, it gets back the placeholder.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#275

Post by cognitiveinline » Mon, Aug 10, 2026, 2:33 PM UTC

angry_octet wrote: post #239

cognitiveinline wrote: post #104

Earlier quoted context omitted.

BS. Unless we're talking 0-day/CVE, running an unprivileged container is as trustable as a VM. The only difference is how strictly you want to hold the memory/CPU bar. Infact on linux, containers are more lightweight than VMs. So yeah, not "vulnerable".

LLMs are great at finding 0-day, and people are rubbish at updating their containers and hosts to patch b-day. Containers have access to the kernel ABI, and as shown in the latest kernel exploits, all the memory handling surface that exposes. The virtualisation interface, offering fewer services, is significantly harder. Containers are obviously lighter than VMs, both to start and to schedule, but firecracker is pret…

Got it. 0 days are possible so throwaway containerization. You should blog about it, will help millions of developers and companies. Heck, even consult with the hyperscalers - they will be riddled with their workloads.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#276

Post by victor_edka » Mon, Aug 10, 2026, 2:33 PM UTC

kwakubiney wrote: post #270

victor_edka wrote: post #267

Earlier quoted context omitted.

yea...I think k8s is de wae for running proper proper rbac sandboxes for agents.

Any idea of anyone exploring this space? Sounds interesting

pfff...yes...but heavily biased as cofounder at edka... we're doing this https://edka.io/blog/codex-environments-on-kubernetes/ and combined with this https://edka.io/docs/agents/conductor/ you'd get that.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#277

Post by everforward » Mon, Aug 10, 2026, 2:34 PM UTC

mikedelfino wrote: post #273

Since everyone is sharing their setup, here’s my approach, just to give people an idea of how others are doing it, however impractical it might look: I run a full Linux VM (with a GUI) on my Linux host. I connect via virt-viewer to run Claude Desktop, as I’m not a fan of using the terminal for this. The VM sits on its own libvirt network in a dedicated firewall zone, and specific directories are shared via filesystem…

Do you find the permanence of a full VM useful? I’ve wondered about something like this but always defaulted to Docker for much the same reasons people use stuff like Ansible. I’m afraid the LLM will heavily customize its environment and I’ll be unable to replicate it when my laptop dies or I can’t upgrade the OS or whatever.

Then again, I guess GUI is a pain in Docker. I tend to operate through Zed and an ACP harness though, so my GUIs are sort of “inside the container” anyways.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#278

Post by westurner » Mon, Aug 10, 2026, 2:36 PM UTC

kstenerud wrote: post #227

rusch wrote: post #58

The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders. I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in. Closest open source I have seen is https://earendil-works.github.io/gondol…

I wrote one that has both of those: yoloAI (MIT, Go, single binary, no login). https://github.com/kstenerud/yoloai Outbound firewall is `--network-isolated`: egress is denied except the agent's own API endpoints plus domains you allow, enforced sandbox-side (working on host-side enforcement now). `--network-none` if you want nothing. Credential brokering works the way you describe (currently Claude-only, I'll add mor…

> yoloAI copies your worktree instead of mounting it

Cloudflare/artifact-fs does lazy shallow git clones with a FUSE filesystem. https://github.com/cloudflare/artifact-fs

Would that be faster?

Re: sandboxing methods like Clawk, Amla sandbox, bwrap, agentvm, ARM64 MTE with wasmtime-mte: https://news.ycombinator.com/item?id=48893850

A few months ago now I started adding seccomp sandboxing to jinja2rs and then liboverlayfs support to ansiblers (which are early Rust ports).

Haven't finished that, but I started working on a VM format that stores signed machine state into an OCI container repository, using the hypervisor migration support of KVM/QEMU.

Though this is not safe yet if ever, VM migrations are probably another way to sandbox and deploy en masse.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#279

Post by arscan » Mon, Aug 10, 2026, 2:38 PM UTC

Not a substantive comment on content but hopefully constructive feedback on presentation:

Holy moly, on mobile I was trying to read the example console screenshots/snippets and then it would just unexpectedly change. Took me a little while to figure out it’s some kind of carousel for the examples, and not more screenshots/snippets loading and pushing down content (or me going crazy). Please don’t do this on mobile sites, just let me scroll through the examples!

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#280

Post by olejorgenb » Mon, Aug 10, 2026, 2:40 PM UTC

Thanemate wrote: post #246

sylvinus wrote: post #213

Earlier quoted context omitted.

Are we all posting our agent VM containers ? :) https://github.com/sylvinus/agent-vm

We're basically at the point where people can build their own "X", with "X" being internal tooling.

Yes, but for certain things like sandboxing I hope we can converge on a handful robust, well-tested/audited solutions...