Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker Sandboxes – Disposable, isolated sandboxes for AI agents

docker.com

Post reply on HN
Print view View original

101–110 of 450 posts

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#101

Post by rusch »

_ink_ wrote: post #87
rusch wrote: post #58

The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders. I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in. Closest open source I have seen is https://earendil-works.github.io/gondol…

Does secret injection really prevent that the agent send my GitHub key somewhere? If it has access to it via env var, can it not just paste it somewhere?

The env var is just a placeholder in the VM, so no real secret is in there.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#102

Post by globular-toast »

angry_octet wrote: post #83
globular-toast wrote: post #63

On Linux, you can skip Docker and use bubblewrap. Some inspiration: https://blog.gpkb.org/posts/ai-agent-sandbox/

Bubble wrap is just containerisation no?

Not sure what you mean by "just". Containerisation is generally understood to mean something like what Docker does, which includes sandboxing but a whole lot more on top, like image management etc. Bubblewrap is just sandboxing without the rest of containerisation.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#103

Post by realexweb »

weinzierl wrote: post #92

Before you use no sandbox at all use this or one the many similar projects but it's alway worth remembering that Docker is not a security boundary. It never has been meant to be and never will become one. cgroups are a mechanism designed for hierarchical organization and resource distribution. Against a malicious and capable actor, and that is how we have to treat AI agents, cgroups will not withstand. Also, the kern…

[flagged]

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#104

Post by cognitiveinline »

angry_octet wrote: post #74
eloisius wrote: post #65

Earlier quoted context omitted.

I have the same question as GP. Your answer helps a little but not really. I might be naive, but I was under the impression that malicious code escaping a docker image and running amok on my host system was not something I should be too worried about. Especially if I run docker in rootless mode. Is that wrong? For clarity I’m actually using podman, not Docker.

Oh no, you should definitely be worried about that. Podman might make it harder to escalate to host root, or manipulate other containers, but it is still vulnerable. Now I'm curious to know how hardened the Docket Sandbox orchestration interface is. I guess we can assume they have run Mythos against it for a few weeks maybe? It's unclear.

BS.

Unless we're talking 0-day/CVE, running an unprivileged container is as trustable as a VM. The only difference is how strictly you want to hold the memory/CPU bar. Infact on linux, containers are more lightweight than VMs.

So yeah, not "vulnerable".

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#105

Post by jachris »

rusch wrote: post #58

The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders. I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in. Closest open source I have seen is https://earendil-works.github.io/gondol…

Agreed. Network control and secret injection together with a microVM setup is as good as it gets right now, although I believe that we need more fine-grained tools down the road. It sounds like Microsandbox would be the perfect fit for what you are describing. I also built my own coding agent workbench on top of it (https://github.com/isolade/isolade). Microsandbox is quite cool, check it out: https://github.com/superradcompany/microsandbox

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#107

Post by randomint64 »

Grimburger wrote: post #37

> Each agent runs inside a dedicated microVM with your dev environment What's a "microVM" and what's the security model here compared to using real virtual machines with actual constraints on breakouts? Is it marketing fluff? Incus/LXD has had VM's for a long time now. incus launch images:ubuntu/26.04 my-ubuntu-vm --vm incus exec my-ubuntu-vm -- bash

[dead]

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#108

Post by masklinn »

Grimburger wrote: post #37

> Each agent runs inside a dedicated microVM with your dev environment What's a "microVM" and what's the security model here compared to using real virtual machines with actual constraints on breakouts? Is it marketing fluff? Incus/LXD has had VM's for a long time now. incus launch images:ubuntu/26.04 my-ubuntu-vm --vm incus exec my-ubuntu-vm -- bash

“microvms” are real vms but the hypervisor and vm (guest kernel) shed most of the hardware / device emulation, support, and discovery which makes traditional VMs look / feel like real computers, as well as most guest interactions. This gives them extremely low overhead.

Firecracker is designed to start a VM in under 125ms and 5MB. Netbsd advertises that you can direct-boot a MICROVM kernel configuration in under 10ms.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#109

Post by binsquare »

nicoty wrote: post #45
binsquare wrote: post #22

Earlier quoted context omitted.

I build a OSS lightweight, portable VM for those that don't want lock ins: https://github.com/smol-machines/smolvm

I have a solution based on Nix that can be used to generate reproducible container images: https://github.com/nothingnesses/agent-images . It lets you customise which agents, harnesses, or any other packages you want included in the VM and it uses `agent-box` for sandboxing.

wonderful, will try to test this in smol machines as well

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#110

Post by MikhailTal »

rusch wrote: post #58

The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders. I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in. Closest open source I have seen is https://earendil-works.github.io/gondol…

https://github.com/e2b-dev/e2b
Post reply on HN