Live data from Hacker News

Docker Sandboxes – Disposable, isolated sandboxes for AI agents

docker.com

441–443 of 443 posts

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#441
I am about to cry. I have been working on a project that actually made me feel I was bringing a new approach until I found this thread with an alarming number of similar tools.. I guess many of us used the same LLMs to help us building our "unique" solutions.

My approach was to remove completely docker and start using podman as rootless daemonless alternative. It also has a good solution to user-namespace mapping when I mount my repositories inside the sandbox.

I let the ai agent make changes but then I review them and push them from my host. As an alternative, you can create a ssh key pair on the host and load it into a dedicated ssh-agent, so you expose that agent socket to the agent container.

For API Tokens and similar credentials, I solved it by putting a credential broker between the podman agent container and the LLM provider. To avoid doing any internal firewalling in the container I run a proxy as a podman container that enforces the egress policy (only https on allowed domains); so no network capabilities are required, the proxy itself handles the filtering.

Because I had the idea of using the sandboxing framework to allow specific communication inside the network (for example for pentesting), it has also (apart from the proxy mode) a "routed"-mode implemented where a podman gateway is started; this does the network filtering without holding any kernel capabilities. nftables is configured using an ephemeral container with net_admin in the same network space (one-shot network initializer).

The framework orchestrates the different required networks and Podman containers.

I haven't tried the Docker solution yet, so I'll avoid comparing them.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#442
post #310

Earlier quoted context omitted.

> Only real alternative is to use microvms. My goto solution for this are apple/containers. Why microVMs? I never ever run a container, AI harness or other, in something else than a full on VM. I could use a microVM but in any case I really don't see why I'd run a container on one of my bare metal OS: the place of a container is inside a VM (or microVM). Especially for AI harnesses where the threat of an escape is ve…

I agree. I thought everybody knew to never use docker for high security, because it is "security lite". Might as well just use firejail. I presume that an agent knows more about networking and virtualization than I do. The only real solution is using multi-tenant level vm isolation, while presuming that the agent still might break out of their vm. So the vms need to be hosted on their own physical box that only runs…

multi-tenant level vm isolation does not solve, imho, specific issues like data exfiltration (ssh private key, api tokens) or privilege escalation, as the vm still contains the whole kernel and userspace inside. So breaking out of the vm may be a realistic scenario.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#443
post #428

Earlier quoted context omitted.

I was just interested how it works, because above it was sold as “it works”, when in reality, “it works*”.

Isn't it that way with most software? "It works", except when it doesn't.

There is a difference between bugs/failures, and false advertisement. The solution used here has well known shortcomings.
Post reply on HN