Posted by niemandhier 15 hours ago
After that we can segment then into civilizations! The [?] processing unit is the limit!
"Open" and "Shell" and just calling something private and safe out the box genuinely makes me think it's likely to fail at all of those claims.
There you go. Just don't tell everyone how it works.
I encountered the same challenge building my toy sandbox. I wanted to use containers because that's what I know best.
The harness is launched in an internal only network. There is a sidecar container that provides mitm credential injection/proxy. I got HTTPS and SSH to work so far.
Claude code was quick to build it. No doubt it's copying previous work in this space though, so I know my work is not that original.
I'm testing all the llms that can be used for pen testing right now to see if/how they manage to escape it. Without a kernel exploit I doubt it's possible (not a very high bar I know).
I'm researching the space. Happy to learn more. Some links in my profile if you're interested.
Of course I’m the type to mount a ftp drive like a moron.
"feat(ai-sandbox): accept MXC policy JSON for protected execution · westurner/sandbox@7538c33" https://github.com/westurner/sandbox/commit/7538c3386af8cb62...
"bwrap: Add the option to skip the procfs mount · Pull Request #1508 · microsoft/mxc" https://github.com/microsoft/mxc/pull/1508
"Manage Sandboxes | NVIDIA OpenShell" https://docs.nvidia.com/openshell/latest/how-it-works/sandbo...
To sandbox LSP servers in sphinxdocrs with bwrap in rootless containers, we needed to add a --no-procfs-mount CLI arg (and MXC JSON) to sandboxes, because you can't mount /proc in a rootless container.