Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's discuss sandbox isolation

shayon.dev

Post reply on HN
Print view View original

11–20 of 75 posts

Re: Let's discuss sandbox isolation

#11

Post by diacritical »

Is there anything more secure than Qubes, assuming enough hardware resources? I'm asking about existing solutions, not theoretical ones. Given its track record so far, I'm betting not, but I'd love to be proven wrong. Adding sandboxing within a VM or hardening it should add more security, but overall I think this is the right approach for anyone who can afford a decent computer.

The attack surface of Xen, the current hypervisor of Qubes, is smaller compared to browsers and OSes that have 0days pathed several times a year. Even most Xen vulns don't affect Qubes.

I just can't imagine putting my whole digital life in one "normal" OS and hoping that the OS or browser security will keep me safe. I'm mentioning the browser because a lot what used to be in the OS is now in the browser, so it's functionally like another OS.

From a usability point of view it's also useful as I can have different environments. Not only different tools in each VM which means I can pretty much forget about dependency issues, but also different data in each VM. If I wanted, I could run any agent or malware on a VM and the exposure would only be whatever data I chose to put in that VM.

Of course, if you're not passing data between certain VMs, you could use different computers for an even better security.

Re: Let's discuss sandbox isolation

#12

Post by stefans »

pash wrote: post #3

OK, let’s survey how everybody is sandboxing their AI coding agents in early 2026. What I’ve seen suggests the most common answers are (a) “containers” and (b) “YOLO!” (maybe adding, “Please play nice, agent.”). One approach that I’m about to try is Sandvault [0] (macOS only), which uses the good old Unix user system together with some added precautions. Basically, give an agent its own unprivileged user account and…

Looked into Apples container framework first (for proper isolation) but switched to Docker sandboxes since they switched to mircoVMs too: https://docs.docker.com/ai/sandboxes/#why-use-docker-sandbox...

Re: Let's discuss sandbox isolation

#13

Post by diacritical »

grouchypumpkin wrote: post #10

QubesOS was built to give sandboxes kernel isolation via a hypervisor. It’s not surprising that most people don’t know about it, because QubesOS as a daily driver can be painful. But with some improvements, I think it’s the right way to do it.

Just posted about Qubes a minute after you did, but I don't find it painful or even time consuming. Initially there was a learning curve, but even if the security of Qubes became the same as the security of a baremetal OS, I would still use it.

When I'm trying to get some software up and running, I've had issues with Debian many times, as well as with Fedora. Rarely with both. With Qubes after a few minutes of trying on Debian and running into some obscure errors, I can just say "fuck it" and try with Fedora, or vice versa. Over the years it has saved me more time than the time I've invested it learning how Qubes works or dealing with Qubes-specific issues.

I also don't have to care about polluting my OS with various software and running into a dependency hell.

If a VM crashes or hangs, it's usually OK, as it's just a VM.

It's much easier to run Whonix or VPNs without worrying for IP leaks.

Re: Let's discuss sandbox isolation

#14

Post by [deleted] »

pash wrote: post #3

OK, let’s survey how everybody is sandboxing their AI coding agents in early 2026. What I’ve seen suggests the most common answers are (a) “containers” and (b) “YOLO!” (maybe adding, “Please play nice, agent.”). One approach that I’m about to try is Sandvault [0] (macOS only), which uses the good old Unix user system together with some added precautions. Basically, give an agent its own unprivileged user account and…

[deleted]

Re: Let's discuss sandbox isolation

#16

Post by yoyohello13 »

CuriouslyC wrote: post #15

Sandbox isolation is only slightly important, you don't need to make it fancy, just a plain old VM. The really important thing is how you control capabilities you give for the agent to act on your behalf.

But managing granular permissions is hard. The common denominator with all these discussions is people want to apply the minimal amount of thinking possible.

Re: Let's discuss sandbox isolation

#17

Post by jbverschoor »

yoyohello13 wrote: post #16
CuriouslyC wrote: post #15

Sandbox isolation is only slightly important, you don't need to make it fancy, just a plain old VM. The really important thing is how you control capabilities you give for the agent to act on your behalf.

But managing granular permissions is hard. The common denominator with all these discussions is people want to apply the minimal amount of thinking possible.

1) can access/write local files?

2) can access/write a specific folder?

3) can access network?

4) can access gateway/internet?

5) can access local network? (vlans would help here)

6) give access to USB devices

7) needs access to the screen? -> giveframebuffer access / drawing primitive

8) Need to write? Use an overlay FS that can be checked by the host and approved

9) sub processes can never escalate permissions

By default: nothing. But unfortunately, it’s always by default allow.

Also, make it simple to remove the permissions again.

Re: Let's discuss sandbox isolation

#18

Post by jbverschoor »

stefans wrote: post #12
pash wrote: post #3

OK, let’s survey how everybody is sandboxing their AI coding agents in early 2026. What I’ve seen suggests the most common answers are (a) “containers” and (b) “YOLO!” (maybe adding, “Please play nice, agent.”). One approach that I’m about to try is Sandvault [0] (macOS only), which uses the good old Unix user system together with some added precautions. Basically, give an agent its own unprivileged user account and…

Looked into Apples container framework first (for proper isolation) but switched to Docker sandboxes since they switched to mircoVMs too: https://docs.docker.com/ai/sandboxes/#why-use-docker-sandbox...

Quite similar to how Im using docker for a few years

https://github.com/jrz/container-shell

Re: Let's discuss sandbox isolation

#19

Post by noperator »

> compute isolation means nothing if the sandbox can freely phone home.

Here's a project I've been working on to address the network risk. Uses nftables firewall allowing outbound traffic only to an explicit pinned domain allowlist (continuously refreshes DNS resolutions in the background).

https://github.com/noperator/cagent

Re: Let's discuss sandbox isolation

#20

Post by scosman »

pash wrote: post #3

OK, let’s survey how everybody is sandboxing their AI coding agents in early 2026. What I’ve seen suggests the most common answers are (a) “containers” and (b) “YOLO!” (maybe adding, “Please play nice, agent.”). One approach that I’m about to try is Sandvault [0] (macOS only), which uses the good old Unix user system together with some added precautions. Basically, give an agent its own unprivileged user account and…

Shell over MCP, with multiple options for sandbox. Includes Docker, Podman, Modal, E2B, and WASM:

https://github.com/Kiln-AI/Kilntainers

Can run anything from a busybox in WASM to a full cloud VM. Agent just sees a shell.

Post reply on HN