Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Zerobox – Sandbox any command with file, network, credential controls

github.com

Post reply on HN
Print view View original

51–60 of 108 posts

Re: Show HN: Zerobox – Sandbox any command with file, network, credential controls

#51

Post by qalfy »

time0ut wrote: post #5

Very interesting. I just started researching this topic yesterday to build something for adjacent use cases (sandboxing LLM authored programs). My initial prototype is using a wasm based sandbox, but I want something more robust and flexible. Some of my use cases are very latency sensitive. What sort of overhead are you seeing?

Wasm sandboxes are fast for pure compute but get painful the moment LLM code needs filesystem access or subprocess spawning. And it will, constantly. Containers with seccomp filters give you near-native speed and way broader syscall support — overhead is basically startup time (~2s cold, sub-second warm). For anything IO-heavy it's not even close. We're doing throwaway containers at https://cyqle.in if anyone's curious.

Re: Show HN: Zerobox – Sandbox any command with file, network, credential controls

#52

Post by afshinmeh »

EGreg wrote: post #50

This is really useful! How well does it compare though to Docker etc. Because I am worried about sandbox escapes. This is what we currently use to sandbox JS inside Browsers and Node (without anything extra) : https://github.com/Qbix/Platform/blob/main/platform/plugins/... I like tools like this, but they all seem to share the same underlying shape: take an arbitrary process and try to restrict it with OS primitives…

Zerobox uses the same kernel mechanisms (namespaces + seccomp) but no daemon, no root and cold start ~10ms (Docker is much worse in that regard).

Docker gives you full filesystem isolation and resource limits. Zerobox gives you granular file/network/credential controls with near zero overhead. You can in fact use Zerobox _inside_ Docker (e.g. for secret management)

Re: Show HN: Zerobox – Sandbox any command with file, network, credential controls

#53

Post by afshinmeh »

_pdp_ wrote: post #47
gigatexal wrote: post #45

there's been so many of these -- which of these sandboxing tools is best?

Not a single one. All of them are solving the obvious (and wrong) problem.

I'd love to learn more please. I'm interested in sandboxing AI tools/agents regardless of the underlying mechanism (I explored Firecracker VMs briefly as well, terrible cross platform support though).

Re: Show HN: Zerobox – Sandbox any command with file, network, credential controls

#54

Post by smallerfish »

Compare with and steal any ideas you like from mine if you like. I've got a semi-decent curl|bash pattern covered, and also add network filtering via pasta (which may be more robust than rolling your own). https://github.com/reubenfirmin/bubblewrap-tui

Re: Show HN: Zerobox – Sandbox any command with file, network, credential controls

#55

Post by simonw »

_pdp_ wrote: post #47
gigatexal wrote: post #45

there's been so many of these -- which of these sandboxing tools is best?

Not a single one. All of them are solving the obvious (and wrong) problem.

What's the right problem to be solving here?

Re: Show HN: Zerobox – Sandbox any command with file, network, credential controls

#56

Post by simonw »

afshinmeh wrote: post #49
blanched wrote: post #44

Earlier quoted context omitted.

What if the program doesn’t respect those env vars? Can Zerobox still block network calls in that case?

Great question! On Linux, yes, network namespaces enforce that and all net traffic goes through the proxy. Direct connections are blocked at the kernel level even if the program ignores proxy env vars, but I will test this case a bit more (unsure how to though, most network calls would respect HTTPS_PROXY and other similar env vars). That being said, the default behaviour is no network, so nothing will be routed if i…

How about on macOS?

Re: Show HN: Zerobox – Sandbox any command with file, network, credential controls

#57

Post by afshinmeh »

smallerfish wrote: post #54

Compare with and steal any ideas you like from mine if you like. I've got a semi-decent curl|bash pattern covered, and also add network filtering via pasta (which may be more robust than rolling your own). https://github.com/reubenfirmin/bubblewrap-tui

Ohh! thanks for sharing this. You are using DNS proxy which is interesting and useful if a process doesn't respect the HTTPS_PROXY/HTTP_PROXY/etc. env vars that I'm injecting. I will take a look, very interesting.

Re: Show HN: Zerobox – Sandbox any command with file, network, credential controls

#58

Post by simonw »

TheTaytay wrote: post #48
simonw wrote: post #26

Earlier quoted context omitted.

Do you know if there's a widely shared name for this pattern? I've been collecting examples of it recently - it's a really good idea - but I'm not sure if there's good terminology. "Credential injection" is one option I've seen floating around.

simonw, I have been seeing "credential injection" and "credential tokenizing" (a la tokenizer: https://github.com/superfly/tokenizer ). I'm also seeing credential "surrogates" mentioned. I am currently working on a mitm proxy for use with devcontainers to try to implement this pattern, but I'm certainly not the only one!

Thanks, I think I'll go with "credential injection" since the word "tokenization" has other meanings that I find confusing here.

Re: Show HN: Zerobox – Sandbox any command with file, network, credential controls

#59

Post by afshinmeh »

simonw wrote: post #56
afshinmeh wrote: post #49

Earlier quoted context omitted.

Great question! On Linux, yes, network namespaces enforce that and all net traffic goes through the proxy. Direct connections are blocked at the kernel level even if the program ignores proxy env vars, but I will test this case a bit more (unsure how to though, most network calls would respect HTTPS_PROXY and other similar env vars). That being said, the default behaviour is no network, so nothing will be routed if i…

How about on macOS?

On macOS, the proxy is best effort. Programs that ignore HTTPS_PROXY/HTTP_PROXY can connect directly. This is a platform limitation (macOS Seatbelt doesn't support forced proxy routing).

BUT, the default behaviour (no net) is fully enforced at the kernel level. Domain filtering relies on the program respecting proxy env vars.

Re: Show HN: Zerobox – Sandbox any command with file, network, credential controls

#60

Post by simonw »

nonameiguess wrote: post #39

This is more a criticism of codex's linux-sandboxing, which you're just wrapping, but it's the first I've ever looked at it. I don't see how it makes sense to invoke bwrap as a forked subprocess. Bubblewrap can't do anything beyond what you can do with unshare directly, which you can simply invoke as a system call without needing to spawn a subprocess or requiring the user to have bwrap installed. It kinds of reeks o…

Is your criticism here that there's no point in invoking bwrap directly when you could instead implement the same things that bwrap implements?

I'd much rather a system call bwrap than re-implement bwrap, because bwrap has already been extensively tested.

Post reply on HN