Here's another sandbox that I found interesting: https://github.com/ashishb/amazing-sandbox

I don't want this that bad. I want the agent to have open access to my system because it actually does important administrative things for me. It is THAT convenient and powerful.

Here's what I want: REALTIME OBSERVABILITY/POWERPOINT.

I don't want to just see what command it ran. I need graphics... what part of the file system it is touching, what network entities it is contacting. If it's running SQL I want the parsed query handed to me in a syntax highlighted and well formatted interface. Imagine that star trek computer presenting automated infographics while someone is doing a presentation, you know what I'm talking about? It's like a automated powerpoint as the agent does it's thing.

I need to understand my agent and what it typically does so I can dangerously wield it. I treat the agent like a gun in a live shooting scenario. That's how I want to use the LLM.

Sandboxes have their purpose. Just like how shooting ranges have their purposes. But I need to fire my gun in the real world and real world is a warzone.

So it's basically a container with a fancy name, innit?

TO me, that's the important distinction: sandboxing limits what the agent can do but it doesn't necessarily enforce that the agent must run inside the sandbox. You need a separate control layer to enforce that boundary.

On Linux, you can skip Docker and use bubblewrap. Some inspiration: https://blog.gpkb.org/posts/ai-agent-sandbox/

...or...just hear me out now...we could limit it in the harness.

Don't give it shell access, just predefined tools.

Just a small meta note: most of the comments in this thread appear to be posting their own codebase (typically AI-generated) that accomplishes the same goal. It's interesting that this problem is simultaneously in high demand and yet considered trivial enough to vibe code per-user solutions to it.

The linked page implies there is no linux support, I wonder why. It's there in the docs if you hunt for it.

Docker management will fail their tech at every opportunity.

[flagged]