Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker Sandboxes – Disposable, isolated sandboxes for AI agents

docker.com

Post reply on HN
Print view View original

261–270 of 424 posts

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#261

Post by lemontheme »

speedgoose wrote: post #123
dethos wrote: post #99

The other day I saw this: https://nono.sh/ Haven't tested it yet, but it seems to address the same issue as Docker Sandboxes, but in a different way.

I have tested it and the big advantage is that is has access to the local development tools. But it’s not as well sandboxed for sure.

Nono has been my daily driver since the start of the year. It's not a perfect sandbox -- that's for sure. For example, the default network rules let you escape via a global TMUX server. But it is extremely practical. It gives me enough guarantees to feel confident about running in YOLO mode. So far nothing has gone awry.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#262

Post by Roark66 »

How about implementing proper permissions on the tool use or if you need more flexibility a dedicated model to analyse potential impact? (Like Claude Code's Autopilot but more configurable)?

I find solutions like this to be a like trying to patch a leaking boat on a lake with duct tape. It will help, but it's not a proper solution.

Also, often the tasks you want the AI to perform are in the outside world. Like "connect to my servers, and figure out X and Y".

The proper way is permission isolation. I run a small k8 cluster in the homelab and I have 3 types of pod/agent combinations for my AI agents. Read only, one that can change my gitops but it needs to create PRs that admin approves, and admin.

Likewise with code. I have a forgejo git instance where agents have ability to create feature branches and so on, but merging is gated.

Those things require "GH enterprise features".

In fact more and more things we do at home will require "enterprise features". Why? Because a person with AI is basically a small team, but some of team members behave like Chimps on crack... So security must be top notch.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#263

Post by dhchun1203 »

Neither of the recent ones was actually a container escape though. The OpenAI one in July found a misconfig in the sandbox network, and Kimi K3 last week just walked out to grab answers off GitHub during an eval.

Both went through stuff the sandbox was set up to allow.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#266

Post by olejorgenb »

eli wrote: post #134
rusch wrote: post #100

Earlier quoted context omitted.

Yes, the stated "target workload"[0] is not what i'm looking for. I want my agent to run for long, spin up dedicated local stack while developing etc. It seems with gondoling i need to explain the agent to run commands in the sandbox, but then where does the agent run itself? [0]: https://earendil-works.github.io/gondolin/workloads/

You can run the agent in the gondolin sandbox if you wish. Their example implementation with pi uses a pi extension so that pi runs on the host but the read/write/bash/etc tools run in the guest. Doesn’t have to be that way though.

Note that the pi-extension example in the gondolin repo is very outdated. Look in the pi repo instead.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#267

Post by victor_edka »

Roark66 wrote: post #262

How about implementing proper permissions on the tool use or if you need more flexibility a dedicated model to analyse potential impact? (Like Claude Code's Autopilot but more configurable)? I find solutions like this to be a like trying to patch a leaking boat on a lake with duct tape. It will help, but it's not a proper solution. Also, often the tasks you want the AI to perform are in the outside world. Like "conne…

yea...I think k8s is de wae for running proper proper rbac sandboxes for agents.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#269

Post by stefanka »

SwellJoe wrote: post #136
stefanka wrote: post #55

Earlier quoted context omitted.

What about bubblewrap? It also provides a sandbox

Yes, bubblewrap is superior to Docker for this. I wrote a tool to use bubblewrap for the purpose. It needs a tool to start it, or is at least much more convenient with a tool, because you need to take your session/auth data into the container, and if you want the agent to be able to start containers (agents love containers) within the container, you need some config magic mounted inside. You could manually do all tha…

Interesting. I’ve been trying to use bwrap, slirp4netns, and mitmproxy to create a simple Python script to get save shell for development. But it’s a huge time sink (and I might resort to podman)

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#270

Post by kwakubiney »

victor_edka wrote: post #267
Roark66 wrote: post #262

How about implementing proper permissions on the tool use or if you need more flexibility a dedicated model to analyse potential impact? (Like Claude Code's Autopilot but more configurable)? I find solutions like this to be a like trying to patch a leaking boat on a lake with duct tape. It will help, but it's not a proper solution. Also, often the tasks you want the AI to perform are in the outside world. Like "conne…

yea...I think k8s is de wae for running proper proper rbac sandboxes for agents.

Any idea of anyone exploring this space? Sounds interesting
Post reply on HN