Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker Sandboxes – Disposable, isolated sandboxes for AI agents

docker.com

Post reply on HN
Print view View original

301–310 of 406 posts

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#301

Post by AlotOfReading »

Roark66 wrote: post #262

How about implementing proper permissions on the tool use or if you need more flexibility a dedicated model to analyse potential impact? (Like Claude Code's Autopilot but more configurable)? I find solutions like this to be a like trying to patch a leaking boat on a lake with duct tape. It will help, but it's not a proper solution. Also, often the tasks you want the AI to perform are in the outside world. Like "conne…

What are the proper permissions for an agent? An agent shouldn't be able to read ~/.ssh, but that means a bash tool that spawns `cat` is different than one that spawns an ssh client. I don't allow my agents to use git commit, except sometimes I ask an agent to split up a complicated branch that I can't be bothered to split myself. rm'ing intermediary files is fine, but rm'ing committed files is bad, unless the agent has done *.bak renaming and is cleaning up itself, etc.

I don't think "proper" permissions are possible without dramatically limiting the way people use these tools.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#302

Post by notsirius »

rusch wrote: post #58

The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders. I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in. Closest open source I have seen is https://earendil-works.github.io/gondol…

Ooh - can you share more about your setup with superset? I tried getting it integrated with superset a while ago with no dice.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#303

Post by kwakubiney »

srini-docker wrote: post #298

I work at Docker. Lot of valid and useful feedback here that we're looking closely at. One correction: this isn't containers. Each session is a microVM with its own kernel on the platform's native hypervisor: Hypervisor.framework, WHP, KVM. We wrote a new VMM (not Firecracker) to make it more effective across platforms. Explained a bit more here about the architecture and why those choices were made: https://www.dock…

Why’s it not on Linux? What are the difficulties with that platform?

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#304

Post by graemep »

TacticalCoder wrote: post #240
pojzon wrote: post #199

Earlier quoted context omitted.

Docker containers are not enough isolation for anyone that cares about jailbreak scenarios. Only real alternative is to use microvms. My goto solution for this are apple/containers.

> Only real alternative is to use microvms. My goto solution for this are apple/containers. Why microVMs? I never ever run a container, AI harness or other, in something else than a full on VM. I could use a microVM but in any case I really don't see why I'd run a container on one of my bare metal OS: the place of a container is inside a VM (or microVM). Especially for AI harnesses where the threat of an escape is ve…

> I really don't understand why people are YOLO'ing containers on their bare metal OS.

You know about the people who do not bother with the container? Quite a few make “No problem so far” comments on HN discussions.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#305

Post by cogman10 »

kwakubiney wrote: post #303
srini-docker wrote: post #298

I work at Docker. Lot of valid and useful feedback here that we're looking closely at. One correction: this isn't containers. Each session is a microVM with its own kernel on the platform's native hypervisor: Hypervisor.framework, WHP, KVM. We wrote a new VMM (not Firecracker) to make it more effective across platforms. Explained a bit more here about the architecture and why those choices were made: https://www.dock…

Why’s it not on Linux? What are the difficulties with that platform?

Looks like they do support Ubuntu.

Is this open source? Can I install this on a non Ubuntu system?

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#306

Post by messh »

mpern wrote: post #208
kellpossible2 wrote: post #165

Earlier quoted context omitted.

what's to stop an agent creating an outbound call with the var to a malicious endpoint? (unless you whitelist what it has access to)

At least for gondolin and microsandbox, you bind a specific secret placeholder to the target host. i.e. your GH token is only replaced/injected for calls to api.github.com, not other hosts. And you can set up both with deny-by-default

But then... why is replacent needed at all: just use sone permissions system.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#308

Post by messh »

mpern wrote: post #208
kellpossible2 wrote: post #165

Earlier quoted context omitted.

what's to stop an agent creating an outbound call with the var to a malicious endpoint? (unless you whitelist what it has access to)

At least for gondolin and microsandbox, you bind a specific secret placeholder to the target host. i.e. your GH token is only replaced/injected for calls to api.github.com, not other hosts. And you can set up both with deny-by-default

Couldn't the agent post then the key in some public comment?

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#309

Post by mirmor23 »

TacticalCoder wrote: post #240
pojzon wrote: post #199

Earlier quoted context omitted.

Docker containers are not enough isolation for anyone that cares about jailbreak scenarios. Only real alternative is to use microvms. My goto solution for this are apple/containers.

> Only real alternative is to use microvms. My goto solution for this are apple/containers. Why microVMs? I never ever run a container, AI harness or other, in something else than a full on VM. I could use a microVM but in any case I really don't see why I'd run a container on one of my bare metal OS: the place of a container is inside a VM (or microVM). Especially for AI harnesses where the threat of an escape is ve…

[dead]

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#310

Post by sgc »

TacticalCoder wrote: post #240
pojzon wrote: post #199

Earlier quoted context omitted.

Docker containers are not enough isolation for anyone that cares about jailbreak scenarios. Only real alternative is to use microvms. My goto solution for this are apple/containers.

> Only real alternative is to use microvms. My goto solution for this are apple/containers. Why microVMs? I never ever run a container, AI harness or other, in something else than a full on VM. I could use a microVM but in any case I really don't see why I'd run a container on one of my bare metal OS: the place of a container is inside a VM (or microVM). Especially for AI harnesses where the threat of an escape is ve…

I agree. I thought everybody knew to never use docker for high security, because it is "security lite". Might as well just use firejail. I presume that an agent knows more about networking and virtualization than I do. The only real solution is using multi-tenant level vm isolation, while presuming that the agent still might break out of their vm. So the vms need to be hosted on their own physical box that only runs the kvm provisioning host (or similar), and is firewalled on its own isolated network. It's a bit of a pain of course, but anything less feels almost like security theatre rather than meaningful to me. Otherwise you need to stick to the remote chatbots only.
Post reply on HN