Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Agent Safehouse – macOS-native sandboxing for local agents

agent-safehouse.dev

Post reply on HN
Print view View original

131–140 of 207 posts

Re: Agent Safehouse – macOS-native sandboxing for local agents

#131

Post by scosman »

paxys wrote: post #101

Not sure I understand this. Agent CLIs already use sandbox-exec, and you can configure granular permissions. You are basically saying - give the agents access to everything, and configure permissions in this second sandbox-exec wrapper on top. But why use this over editing the CLI's settings file directly (e.g. https://code.claude.com/docs/en/sandboxing#configure-sandbox... )?

I have sandbox-exec setup for Claude like you suggest, but I’m not sure every CLI supports it? Claude only added it a month or two ago. A wrapper CLI that allows any command to be sandboxed is pretty appealing (Claude config was not trivial).

The downside is that it requires access to more than it technically needs (Claude keys for example). I’m working on a version where you sandbox the agent’s Bash tool, not the agent itself. https://github.com/Kiln-AI/Kilntainers

Re: Agent Safehouse – macOS-native sandboxing for local agents

#132

Post by e1g »

camkego wrote: post #125
e1g wrote: post #78

Earlier quoted context omitted.

Fair! You don’t actually need to install anything and can just generate a text file with the security profile for sandbox-exec. You can do that online at https://agent-safehouse.dev/policy-builder.html Alternatively, you can feed these instructions to your LLM and have it generate you a minimal policy file and a shell wrapper https://agent-safehouse.dev/llm-instructions.txt

I think if the online builder could have been the whole project, that would be neat! Truly "zero-trust", what I think many HN readers want. Anyway, thanks for building Agent Safehouse.

That’s a great idea. I think I’ll restructure the entire project to be based around a collection of community managed rules, a UI generator to build a custom text file from those rules, and an LLM skill so people can evolve their policies themselves. The Bash script will remain in the background as one implementation, but shouldn’t be the only way.

Re: Agent Safehouse – macOS-native sandboxing for local agents

#134

Post by e1g »

oneplane wrote: post #82
e1g wrote: post #78

Earlier quoted context omitted.

Fair! You don’t actually need to install anything and can just generate a text file with the security profile for sandbox-exec. You can do that online at https://agent-safehouse.dev/policy-builder.html Alternatively, you can feed these instructions to your LLM and have it generate you a minimal policy file and a shell wrapper https://agent-safehouse.dev/llm-instructions.txt

That online builder is very cool, well done! I've been trying out similar things to help internal teams to use systems and languages like Rego (for Open Policy Agent) to have a visual and more 'a la carte' experience when starting out, so they don't have to jump straight to learning all syntax and patterns for a language they might have never seen before.

Thanks, Codex helped to put that together in like 20 minutes. Try feeding your agent the idea about an interactive config builder, give it the upstream URL with your condos, and see if it can whip up something for you.

Re: Agent Safehouse – macOS-native sandboxing for local agents

#135

Post by mikemcquaid »

pash wrote: post #36

Sandvault [0] (whose author is around here somewhere), is another approach that combines sandbox-exe with the grand daddy of system sandboxes, the Unix user system. Basically, give an agent its own unprivileged user account (interacting with it via sudo, SSH, and shared directories), then add sandbox-exe on top for finer-grained control of access to system resources. 0. https://github.com/webcoyote/sandvault

Yeh I came here to post this. I preferred this approach as user permissions are a bit easier to consistently verify as a second layer of defence.

I also found the author to be helpful and responsive and the tool to be nicely minimalistic rather than the usual vibe coded ever expanding mess.

‘brew install sandvault’ and running ‘sv’ should get you going.

(full disclosure: I created the Homebrew formula and submitted a few PRs to the project)

Re: Agent Safehouse – macOS-native sandboxing for local agents

#136

Post by e1g »

big_toast wrote: post #93
e1g wrote: post #62

Earlier quoted context omitted.

Thank you for your work - I have sent many of your links to my people. Your point is totally fair for evaluating security tooling. A few notes - 1. I implemented this in Bash to avoid having an opaque binary in the way. 2. All sandbox-exec profiles are split up into individual files by specific agent/integration, and are easily auditable ( https://github.com/eugene1g/agent-safehouse/tree/main/profil... ) 3. There are…

I love this implementation. Do you find the SBPL deficient in any ways? Would xcodebuild work in this context? Presumably I'd watch a log (or have an agent) and add permissions until it works?

SBPL is great for filesystem controls and I haven’t hit roadblocks yet. I wish it offered more controls of outbound network requests (ie filtering by domain), but I understand why not.

Yes, Safehouse should work for xcodebuild workloads in the way you described - try to run it, watch for failures, extend the profile, try again. Your agent can do this in a loop by itself - just feed it the repo as there are many integrations that are not enabled by default that will help it.

Re: Agent Safehouse – macOS-native sandboxing for local agents

#137

Post by zmmmmm »

silverstream wrote: post #47
zmmmmm wrote: post #38

This is great to see. I honestly think that sandboxing is currently THE major challenge that needs to be solved for the tech to fully realise its potential. Yes the early adopters will YOLO it and run agents natively. It won't fly at all longer term or in regulated or more conservative corporate environments, let alone production systems where critical operations or data are in play. The challenge is that we need a m…

File-level sandboxing is table stakes at this point — the harder problem is credentials and network. An agent inside sandbox-exec still has your AWS keys, GitHub token, whatever's in the environment. I've been running a setup where a local daemon issues scoped short-lived JWTs to agent processes instead of passing raw credentials through, so a confused agent can't escalate beyond what you explicitly granted. Works we…

Every post from this two day old account starts with about 8 words and then an em-dash. And it happens to self-identify a startup building infra for OpenClaw.

Re: Agent Safehouse – macOS-native sandboxing for local agents

#138

Post by _jdtm »

naomi_kynes wrote: post #13

The "full-auto" framing is interesting. What happens when the agent hits something it can't resolve autonomously? Even sandboxed, there's a point where the agent needs to ask a question or get approval. Most setups handle this awkwardly: fire a webhook, write to a log, hope the human is watching. The sandbox keeps the agent contained, but doesn't give it a clean "pause and ask" primitive. The agent either guesses (ri…

[dead]

Re: Agent Safehouse – macOS-native sandboxing for local agents

#139

Post by carderne »

jeff_antseed wrote: post #129

[dead]

There is sandbox-runtime [1] from Anthropic that uses bubblewrap to sandbox on Linux (and works the same as OP on macOS). You can look at the code to see how it uses it. Anthropic's tool only support read blacklist, not a whitelist, so I forked it yesterday to support that [2].

[1] https://github.com/anthropic-experimental/sandbox-runtime [2] https://github.com/carderne/sandbox-runtime

Re: Agent Safehouse – macOS-native sandboxing for local agents

#140

Post by carderne »

How do agents tend to deal with getting blocked? Messing around with sandboxes, I've quite even seen them get blocked, assume something is wrong, and go _crazy_ trying to get around the block, never stopping to ask for user input. It might be good to add to the error message: "This is deliberate, don't try to get around it."

For those using pi, I've built something similar[1] that works on macOS+Linux, using sandbox-exec/bubblewrap. Only benefit over OP is that there's some UX for temporarilily/permanently bypassing blocks.

[1] https://github.com/carderne/pi-sandbox

Post reply on HN