7 ms·
Show HN: I Built a Sandbox for Agents
- bosky101 8mo agoThe right link is https://github.com/vrn21/bouvet https://github.com/vrn21/bouvet
- nadis 8mo agoThank you.
- ripped_britches 8mo agoWhy is it a problem to use containers?
- vrn21 8mo agoevery syscall on containers run on the kernal with full privelages, so if needed one can break out of the container and get access to the host
- ripped_britches 8mo ago> with full privs No that’s just a misconfigured container then. Unless there is an exploit on an unpatched kernel bug, a properly configured container shouldn’t allow break out
- deleted 8mo ago[deleted]
- _pdp_ 8mo agoWe use a service but it is always nice to have a free option if you need it. Good stuff.
- vrn21 8mo agousing sandboxes makes a lot of sense now a days, but this is nowhere near the prod sandboxes the market has, they have a lot of work and optimizations going on! but yeah its little fun side project! thanks for the compliments :)
- canadiantim 8mo agoThis relies on the agent requesting a sandbox... which seems like the fox guarding the hen house, no?
- vrn21 8mo agotbh, this is kind of a gray area, i should have thought little bit more on how it should have been architectured, for me this was the ideal scenario: a cloud model on web with its own sandbox (something like claude with read/write to files and run commands) i dont really think this could be considered as a fox guarding the hen house, its not that ai wants to infect your computer with its commands, if ai is provided the mcp server, it will it instead of using the tools like bash in most cases [if in a local setup]. I feel its more of a lumberjack guarding his weapons.
- monomial 8mo agoIs this a common pattern to have an agent request a sandbox? I feel like I'd want the whole agent running in it's own sandbox to begin with. Firecracker does look like a decent solution for that.
- cr125rider 8mo agoIs firecracker instead of a docker container worth the hassle?
- kernc 8mo agoProbably not. Maybe Bubblewrap and sandbox-run. It's an anything-is-already-way-better-than-nothing type of thing. [0]: https://github.com/containers/bubblewrap https://github.com/containers/bubblewrap [1]: https://github.com/sandbox-utils/sandbox-run https://github.com/sandbox-utils/sandbox-run
- mccraveiro 8mo agoI agree. I'm testing https://sprites.dev/ https://sprites.dev/ because of that.
- vrn21 8mo agoWhen I started to design the system, I thought of creating a way for an agent on the cloud to have access to a filesystem, such that they can read, write files and run commands. I can't really say that the startups in the space's main source of income is this, most of them rely on sdks for other platforms. I could adjust the core to work as a sdk as well, but right now the main interface is just a mcp server that a client can use
- sahiljagtapyc 8mo agointeresting
- debarshri 8mo agoCan someone elaborate with whats wrong with having containers for sandbox?
- binsquare 8mo agoIt's because containers share the kernel with the host. Generally it's just not considered a security boundary. (Note that containers have come a longer way in the security side btw) So it's a mostly security thing.
- debarshri 8mo agoBut in the context of agents. Does it matter?
- tptacek 8mo agoDepends. Probably not usually. I've thought about this a bunch and I think the serious "threat" here isn't the agent acting maliciously --- though agents will break out of non-hardened sandboxes! --- but rather them exposing some vulnerability that an actual human attacker exploits.
- deleted 8mo ago[deleted]
- buu700 8mo agoI'd also add that I just don't like the idea in principle that I should have to trust the agent not to act maliciously. If an agent can run rm -rf / in an extreme edge case, theoretically it could also execute a container escape. Maybe vanishingly unlikely in practice, but it costs me almost nothing to use a VM just in case. It's not impossible that certain models turn out to be poorly behaved, that attackers successfully execute indirect prompt injection via malicious tutorials targeting coding agents, or that some shadowy figure runs a plausibly deniable attack against me through an LLM API.
- debarshri 8mo ago
- tomasphan 8mo agoSeems these thing pop up here ever so often. Either using firecracker or docker/containers. How is this different from the other sandboxes? BTW I love that you got LLM testimonials lol
- binsquare 8mo agoI'm building an alternative to firecracker here if you're looking for something wayy different: https://github.com/smol-machines/smolvm https://github.com/smol-machines/smolvm
- aghilmort 8mo agowe've considered docker, firecracker, will add smol to working roster context <> building something with QEMU * required has to support LMW+AI (linux/mac/windows + android/ios) there are scenarios in which we might spin micro vms inside that main vm, which by default is almost always Debian Linux distro with high probability. one scenario is say ETL vm and AI vm isolated for various things curious why building another microVM other than sheer joy of building, what smol does better or different, why use smol, etc. (microVMs to avoid etc also fair game :)
- jkelleyrtp 8mo agoI needed Mac / win/ Linux / iOS / android for dioxus dev, so I built my own in rust. https://skyvm.dev/ https://skyvm.dev/
- binsquare 8mo agoI focus on different design decisions. Smolvm is designed to run locally, persistent (stateful), long running (efficiency), and interactive. Worked with firecracker and other options a lot btw, most of everything is designed for ephemeral serverless workloads.
- aghilmort 8mo agooh interesting our qemu use case is local!
- binsquare 8mo agoCool option, I'm building in the same space. We should chat!
- vrn21 8mo agohi, you could find my socials at https://vrn21.com https://vrn21.com, feel free to dm :)
- avaer 8mo agoGiven that this is using Firecracker, is it Linux only?
- vrn21 8mo agoyes, it is supposed to be hosted on bare metal linux machines; anyone on any machine can use it as a sandbox after adding the mcp server to the client
- coip 8mo agoAnyone have any thoughts on this path if using macOS? Been using it, seems to do the trick pretty well out of the box. https://developer.apple.com/documentation/Virtualization/running-macos-in-a-virtual-machine-on-apple-silicon https://developer.apple.com/documentation/Virtualization/run...
- vrn21 8mo agoi think https://github.com/trycua/cua https://github.com/trycua/cua has some sort of it working
- aghilmort 8mo agointeresting is the idea the agent calls it or just alt to terminal bash etc tool calls hey your tool calls are all microvms, containers, isoshells, raw term, clawd/molt all credentials with weaker and weaker security demarcs?
- vrn21 8mo agomy ideal scenario is a cloud web model getting access to a sandbox to run commands and read/write to files. but yeah it could be used as an alternative to bash and read write tools. I did not get your second question exactly, but yeah microvms can be considered one of the secure ways to run your agent
- aghilmort 8mo agoBasically, just thinking that it’s more ideal to have the tool call the micro VM versus the agent, doing it in the sense of its mandated by the tool call
- FEELmyAGI 8mo agoGreat idea that is already implemented as a feature by major AI providers, several well funded startups, countless unfunded startups, and trivially solved per-user with any handful of existing technologies. Truly baffling its in the top 5 of the front page. My first thought was bot army upvoting but the total points are quite low. That means this is some mod's personal idea of an especially interesting submission?
- deleted 8mo ago[deleted]
- arscan 8mo agoHaving testimonials attributed to Gemini 3 Pro and Claude 4.5 Opus is... interesting. I'm curious what prompt was used to get those quotes.
- vrn21 8mo agolol thanks for the compliments, generated both the testimonials after giving the mcp server to both opus and gemini and asked their feedback on it. it is supposed to be directly used by agents, so they are kind of my end users, hence it made sense to get their testimonials :)
- ATechGuy 8mo agoCongrats on launching, and great testimonials! What problem does it solve compared to bazillion code execution sandboxing agents (and containers/VMs)? Overall, a lot of people are building their own code execution sandboxing agents around containers/VMs. Curious to know what's missing that makes people DIY this? Here's my list of code execution sandboxing agents launched in the last year alone: 1. E2B 2. AIO Sandbox 3. Sandboxer 4. AgentSphere 5. Yolobox 6. Exe.dev 7. yolo-cage 8. SkillFS ERA Jazzberry Computer Vibekit Daytona Modal Cognitora YepCode Run Compute CLI Fence Landrun Sprites pctx-sandbox pctx Sandbox Agent SDK Lima-devbox OpenServ Browser Agent Playground Flintlock Agent Quickstart Bouvet Sandbox Arrakis Cellmate (ceLLMate) AgentFence Tasker
- vrn21 8mo agoThanks for the compliments! I can't really say that it has a unique differentiator between all the other sandboxes out in the market, this was supposed to be a poc version on how i could be building a sandbox for agents, this had been haunting me since a few months, tried out what could happen! the actual sandboxes in the market are doing a lot of work in optimizing the system end to end, and most of it is pretty hard. this project just scratches the surface
- vrn21 8mo agoyes this is pretty busy market, but it is just pure infra/OS problem and many of it has already been solved in the past decades, right now its just who can fit everything together fastest
- nadis 8mo agoGetting a 404 page not found for this project - how can I try it?
- vrn21 8mo agoSorry for the issue with the link, the accurate link is: https://github.com/vrn21/bouvet https://github.com/vrn21/bouvet
- cadamsdotcom 8mo agoYou built a voluntary sandbox and it also uses lots of tokens in the context to load in the MCP definition? Just looking to understand if the sandbox can be bypassed?