# ============================================================================= # AI Agent Sandboxes — structured dataset (evidence-carrying edition) # # Derived from: "AI Sandboxes and Adjacent Approaches from the Clawk Hacker # News Thread" (HN item 48892859) plus the official docs cited therein. # # v0.2.0 change: no bare ratings. Every non-identity field is a CLAIM that # carries its evidence. Fields with no evidentiary basis were deleted # (the v0.1 setup_burden / approval_friction / state_ergonomics scales). # # v0.2.1 change: primary-source audit pass (2026-07-14). Fixed stale version # bases, wrong credential/network classifications, overclaimed agent lists, # and promoted aide from adjacent-orchestrator to a principal sandbox entry. # # v0.2.2 change: added nono.sh and strongdm/leash (2026-07-20), both sourced # from a user-submitted recommendation (private email) rather than the HN # thread — see their thread_status fields. # # v0.2.3 change: full primary-source re-audit (2026-07-20), fanned out across # parallel research agents plus an independent codex CLI cross-check (grok # unavailable — not authenticated in this box). Fixes: added agents shipped # since the last audit (clawk: opencode; flar, yolobox: kimi_code; agentjail # version bump to v0.9.0 + Monitor Mode); fixed a dead instavm_coderunner blog # link; upgraded exe_dev.credential_mediation from unspecified to # managed_integration (Integrations docs); noted the sprites.dev -> fly.io/ # sprites redirect; corrected claude_code_sandbox's maturity (no longer beta — # that label now belongs to a separate @anthropic-ai/sandbox-runtime package), # added missing windows_wsl2 platform, replaced an unsupported os_keyring # credential_mediation claim with the actual ambient/deny/mask mechanism, and # corrected an overclaimed compliance field (ISO/IEC 42001 is aspirational # only, no active certifications); replaced codex_sandbox's same unsupported # os_keyring claim with unspecified; resolved nono's network-default hedge and # noted its --env-credential fallback mode; corrected nix_opencode_with_mitm's # overclaimed token-injection feature (aspirational in the source, not # shipped); re-sourced wasm_substrates' container2wasm link to its own repo. # Also fixed a pre-existing, dataset-wide YAML correctness bug: 23 inline # flow-mapping values contained an unquoted comma, which any standards- # compliant YAML parser (confirmed via Python's PyYAML, not just this repo's # lenient yq) silently splits into a truncated string plus a bogus null-valued # key — corrupting data for any real consumer, not just a display quirk. # Quoted every affected value; verified zero remain via an automated scan. # # v0.2.4 change: grok CLI came back online after v0.2.3 shipped, so it ran # the same 5-question second opinion pass codex had already done for # claude_code_sandbox/codex_sandbox. All 5 answers matched codex and this # dataset's edits. One refinement from grok's answer: reworded # claude_code_sandbox.compliance so it's scoped to what the two cited # engineering posts say, not read as "Anthropic holds no certifications # anywhere" — Anthropic's separate Trust Center does document an actual # SOC 2 Type II report and ISO 27001 certificate at the company level; the # two sandboxing/containment posts just don't discuss it. # # v0.2.5 change: closed the agents_supported and platforms taxonomies. Both # were free text — 31 distinct agent ids and 16 platform ids across the # sandboxes, full of near-duplicates (claude/claude_code/claude_code_cited; # gemini/gemini_cli; macos/macos_cloud/macos_apple_silicon; wsl/windows_wsl2) # that made the site's facet filters noisy rather than useful. Added closed # `taxonomy.agents_supported` (21 ids) and `taxonomy.platforms` (11 ids) lists # and migrated every sandbox entry onto them. Nowhere was data silently # dropped: any nuance an old id used to carry alone (virtdev's # claude_code_cited meaning "mentioned in passing, not a real integration"; # instavm_coderunner's macos_apple_silicon meaning "Apple Silicon only, not # Intel") now lives explicitly in that field's basis text instead. # # v0.2.6 change: added three sandboxes entries (2026-07-20). Greywall # (GreyhavenHQ) -- container-free deny-by-default OS sandbox (bubblewrap/ # Landlock/seccomp/eBPF + kernel-level TUN network capture on Linux, Seatbelt # on macOS) with host-side credential substitution; user-submitted # recommendation. Fence (fencesandbox, formerly Use-Tusk) -- the lighter-weight # sandbox Greywall's authors evaluated and moved away from, added while # investigating that history; default network policy turned out to be # kernel-enforced on both platforms (not cooperation-dependent, as first # assumed), but credentials stay ambient -- no substitution mechanism. # Omnigent/Omnibox (Databricks) -- OS-sandbox feature bundled inside an # open-source multi-agent meta-harness (classified runtime_feature, not a # standalone tool); its Windows backend turned out to provide only # process-tree kill-on-close, not the CPU/memory ceilings its own docs # describe. All three: ships profiles/integrations for several agents with no # id in the closed agents_supported taxonomy (Amp, Cline, Kilo, Auggie, Droid, # Crush, Kiro) -- recorded in each entry's basis text rather than growing that # taxonomy per-agent, a deliberate call not to chase every individual agent # id. A fourth candidate (XaresAICoder, a self-hosted browser IDE bundling # several agent CLIs) was investigated and deliberately left out: real, # actively maintained project, but a generic dev-environment container (like # github_codespaces) rather than a boundary purpose-built around an agent's # threat model -- no default egress policy, no credential mediation, and # seccomp explicitly disabled for debugger compatibility. # ============================================================================= meta: title: AI Agent Sandboxes & Adjacent Approaches version: "0.2.6" generated: "2026-07-14" updated: "2026-07-20" primary_thread: title: "Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop" url: "https://news.ycombinator.com/item?id=48892859" evidence_levels: official: Stated in the product's own docs, README, or vendor engineering posts. thread: Asserted by commenters in the HN thread; not vendor-confirmed. editorial: Inference by the dataset authors; must show its basis. conventions: >- Any classification/risk/cost/convenience field is either a plain scalar/list (SHORTHAND) or a CLAIM OBJECT. Shorthand means evidence level "official", sourced from the entry's default_source. Claim objects have keys {value, ev, src, basis, derived_from}; ev defaults to official and src defaults to default_source when omitted. Every ev: editorial claim MUST carry a basis and, where applicable, derived_from listing the documented fields it was inferred from. A renderer's "official claims only" toggle hides any claim whose effective ev is not official. The literal string "unspecified" means primary sources were silent — render it as a visible badge, never a blank cell. # ----------------------------------------------------------------------------- # Taxonomy — closed vocabularies for filterable facets. # (v0.1's editorial cost/convenience ordinal scales are gone; only facets that # can be grounded in documentation remain.) # ----------------------------------------------------------------------------- taxonomy: product_role: - {id: runtime, label: Sandbox runtime, description: Directly creates and owns the execution boundary.} - {id: runtime_feature, label: Built-in sandbox feature, description: Sandboxing shipped inside a larger agent product.} - {id: policy_wrapper, label: Policy wrapper, description: Intercepts or supervises another runtime's tool calls.} - {id: remote_workspace, label: Remote workspace, description: Hosted dev environment usable as an agent sandbox.} - {id: orchestrator, label: Orchestrator, description: Launches or supervises agents; not itself the trust boundary.} - {id: template, label: Template / recipe, description: Reusable setup pattern built on other substrates.} - {id: pattern, label: DIY pattern, description: An approach, not a product.} execution_locus: - {id: local, label: Local (user's machine)} - {id: self_hosted_remote, label: Self-hosted remote} - {id: vendor_cloud, label: Vendor-managed cloud} - {id: hybrid, label: Hybrid local + cloud} isolation_boundary: # Ordered weakest -> strongest always-on boundary. `strength` lets the UI # derive footprint/credibility framing from the documented boundary itself # instead of storing per-entry editorial ratings. - {id: user, label: Separate OS user, strength: 1} - {id: os_sandbox, label: OS sandbox (Seatbelt / Bubblewrap / seccomp), strength: 2} - {id: container, label: Container / namespace, strength: 3} - {id: microvm, label: MicroVM (Firecracker / QEMU microVM / Apple container), strength: 4} - {id: vm, label: Full VM (KVM / QEMU / hypervisor), strength: 5} - {id: layered, label: Layered (multiple essential boundaries), strength: null} state_model: - {id: ephemeral, label: Ephemeral — resets by design} - {id: resumable, label: Resumable — sessions/snapshots survive} - {id: persistent, label: Persistent — disks/volumes survive indefinitely} - {id: copy_apply, label: Copy/diff/apply — changes staged in a clone} - {id: configurable, label: Configurable per mode} network_policy: - {id: open, label: Open outbound by default} - {id: allowlist, label: Outbound allowlist} - {id: proxy_mediated, label: Inspecting / mediating proxy} - {id: none, label: No network} - {id: operator_managed, label: Operator/vendor-managed policy} - {id: configurable, label: Configurable (open/allowlist/none modes)} credential_mediation: - {id: ambient, label: Ambient — host env visible to agent} - {id: mounted, label: Mounted — secret present inside runtime as file/env} - {id: forwarded, label: Forwarded — e.g. SSH agent socket, key stays off-guest} - {id: host_side_injection, label: Host-side injection — secret added only on egress} - {id: os_keyring, label: OS keyring — agent auth in system keychain} - {id: managed_integration, label: Managed integration — vendor service connector} - {id: unspecified, label: Unspecified in primary sources} threat_tier: - id: t1_accidents label: Accidents description: Agent runs a destructive command in the wrong place. - id: t2_exfiltration label: Prompt-injection exfiltration description: Agent tricked into shipping secrets or data out; needs egress control and/or credential mediation. - id: t3_hostile_escape label: Hostile code escape description: Malicious code attempts to break the boundary; hypervisor-class isolation is the broadly credible answer. design_intent: - {id: constrain, label: Constrain the agent, description: "Check, gate, or block agent actions."} - {id: liberate, label: Liberate the agent, description: Build a wall so the agent can run unsupervised inside it.} - {id: both, label: Both / configurable} pricing_model: # Factual, documentable. Replaces v0.1's editorial cost block. - {id: free_oss, label: Free / open source} - {id: free_tier_plus_usage, label: Free tier + pay-as-you-go} - {id: paid_usage, label: Usage-based paid} - {id: paid_subscription, label: Subscription (may add usage)} - {id: contact_sales, label: Contact sales / pricing in flux} - {id: product_feature, label: Bundled feature of a paid product} - {id: unspecified, label: Unspecified in primary sources} # Closed v0.2.5 -- previously free text (31 distinct ids for agents, 16 for # platforms, full of near-duplicates like claude/claude_code/claude_code_cited # or macos/macos_cloud/macos_apple_silicon). Every entry's agents_supported # and platforms values now resolve to one of these ids; any nuance an old id # used to carry alone (e.g. "cited as an example, not a first-class # integration") now lives in that field's basis text instead. agents_supported: - {id: claude_code, label: Claude Code} - {id: codex, label: Codex CLI} - {id: gemini_cli, label: Gemini CLI} - {id: copilot, label: GitHub Copilot} - {id: cursor, label: Cursor} - {id: aider, label: Aider} - {id: opencode, label: OpenCode} - {id: pi, label: Pi} - {id: qwen_code, label: Qwen Code} - {id: grok, label: Grok} - {id: goose, label: Goose} - {id: antigravity, label: Antigravity} - {id: openclaw, label: OpenClaw} - {id: hermes, label: Hermes} - {id: reasonix, label: Reasonix} - {id: kimi_code, label: Kimi Code} - {id: shelley, label: Shelley (web agent)} - {id: moltbot, label: Moltbot (Clawdbot)} - {id: mcp_orchestrated, label: MCP-orchestrated agents (generic), description: Named as supporting agents driven via MCP rather than a specific product.} - {id: generic_command_execution, label: Generic command execution, description: Runs arbitrary shell commands; not tied to any named agent.} - {id: agent_agnostic, label: Any agent (agent-agnostic), description: "Stated to work with whatever agent you point at it, without naming specific ones."} # Platforms conflates host OS with access method by design of the source # data (e.g. exe.dev and Fly Sprites are fully remote, so "platform" means # how you reach them, not an OS) -- rather than force a schema split, this # stays one closed list, disambiguated by label. Hosting/locus (local vs. # vendor-cloud) is already classification.execution_locus's job, so the old # macos_cloud/linux_cloud/arch_linux_host/macos_apple_silicon ids collapse # to their base OS here, with any real constraint (Arch specifically, # Apple Silicon specifically) kept in that entry's platforms basis. platforms: - {id: macos, label: macOS} - {id: linux, label: Linux} - {id: windows_wsl2, label: Windows (WSL2)} - {id: windows_powershell, label: Windows (native, PowerShell)} - {id: cloud, label: Cloud (hosted execution mode)} - {id: browser, label: Browser} - {id: vscode, label: VS Code} - {id: cli, label: CLI} - {id: api, label: API} - {id: sdk, label: SDK} - {id: ssh, label: SSH} # ----------------------------------------------------------------------------- # Sources registry — claims reference these by id via `src`. # ----------------------------------------------------------------------------- sources: hn_thread: {url: "https://news.ycombinator.com/item?id=48892859", title: "Show HN: Clawk (HN thread)"} clawk_repo: {url: "https://github.com/clawkwork/clawk", title: "Clawk README"} agentjail_repo: {url: "https://github.com/LuD1161/agentjail", title: "agentjail README"} gondolin_docs: {url: "https://earendil-works.github.io/gondolin/", title: "Gondolin documentation"} gondolin_repo: {url: "https://github.com/earendil-works/gondolin", title: "Gondolin repo (verified 2026-07-14)"} gondolin_security: {url: "https://github.com/earendil-works/gondolin/security", title: "Gondolin security design"} flar_repo: {url: "https://github.com/swelljoe/flar", title: "flar README"} yoloai_repo: {url: "https://github.com/kstenerud/yoloai", title: "yoloAI README"} virtdev_repo: {url: "https://github.com/matheusmoreira/virtdev", title: "virtdev README"} exe_dev_site: {url: "https://exe.dev/", title: "exe.dev site & docs"} exe_dev_pricing: {url: "https://exe.dev/pricing", title: "exe.dev pricing"} exe_dev_blog: {url: "https://blog.exe.dev/meet-exe.dev", title: "Meet exe.dev (blog)"} sprites_docs: {url: "https://docs.sprites.dev/", title: "Fly.io Sprites docs"} agentcage_repo: {url: "https://github.com/agentcage/agentcage", title: "agentcage README"} coderunner_repo: {url: "https://github.com/instavm/coderunner", title: "InstaVM CodeRunner README"} instavm_blog: {url: "https://instavm.io/blog/nixos-reproducible-dev-environments-on-instavm", title: "InstaVM NixOS sandboxes (blog)"} yolobox_repo: {url: "https://github.com/finbarr/yolobox", title: "yolobox README & security model"} bitrise_rde: {url: "https://bitrise.io/platform/remote-dev-environments", title: "Bitrise RDE product page & docs"} codespaces_docs: {url: "https://github.com/features/codespaces", title: "GitHub Codespaces docs"} anthropic_sandboxing: {url: "https://www.anthropic.com/engineering/claude-code-sandboxing", title: "Anthropic: Claude Code sandboxing"} anthropic_containment: {url: "https://www.anthropic.com/engineering/how-we-contain-claude", title: "Anthropic: How we contain Claude"} codex_security: {url: "https://learn.chatgpt.com/docs/agent-approvals-security", title: "OpenAI: Agent approvals & security"} codex_sandboxing: {url: "https://learn.chatgpt.com/docs/sandboxing?surface=app", title: "OpenAI: Codex sandboxing docs"} byre_repo: {url: "https://github.com/pjlsergeant/byre", title: "byre README"} paseo_docs: {url: "https://paseo.sh/docs/providers", title: "Paseo providers docs"} skynot_repo: {url: "https://github.com/tarsgate/skynot", title: "skynot README"} takeaicontrol_repo: {url: "https://github.com/daitangio/take-ai-control", title: "take-ai-control README"} aide_repo: {url: "https://github.com/jskswamy/aide/", title: "Aide README"} scratch_repo: {url: "https://github.com/housecat-inc/scratch", title: "scratch README"} katsuobushi_repo: {url: "https://github.com/cdata/katsuobushi/tree/main/lib/sandbox", title: "katsuobushi sandbox"} nix_mitm_repo: {url: "https://github.com/riedel/nix-opencode-with-mitm", title: "nix-opencode-with-mitm README"} nono_repo: {url: "https://github.com/nolabs-ai/nono", title: "nono README"} nono_site: {url: "https://nono.sh/", title: "nono site"} nono_docs: {url: "https://nono.sh/docs/llms.txt", title: "nono docs (llms.txt)"} leash_repo: {url: "https://github.com/strongdm/leash", title: "Leash (strongDM) README"} leash_disclaimer: {url: "https://raw.githubusercontent.com/strongdm/leash/main/DISCLAIMER.txt", title: "Leash DISCLAIMER.txt"} claude_code_sandbox_docs: {url: "https://code.claude.com/docs/en/sandboxing", title: "Claude Code docs: Configure the sandboxed Bash tool (post-migration canonical doc)"} claude_code_security_docs: {url: "https://code.claude.com/docs/en/security", title: "Claude Code docs: Security"} anthropic_trust_center: {url: "https://trust.anthropic.com", title: "Anthropic Trust Center"} exe_dev_docs: {url: "https://exe.dev/docs/integrations", title: "exe.dev docs: Integrations"} user_email_2026_07_20: {url: null, title: "User-submitted comparison, private email, 2026-07-20 (not part of the HN thread)"} greywall_repo: {url: "https://github.com/GreyhavenHQ/greywall", title: "Greywall README"} greywall_site: {url: "https://greywall.io/", title: "Greywall site"} greywall_docs: {url: "https://docs.greywall.io/greywall", title: "Greywall docs: Install & Platform Support"} greywall_agent_profiles_tree: {url: "https://github.com/GreyhavenHQ/greywall/tree/main/internal/profiles/agents", title: "Greywall repo: internal/profiles/agents (verified 2026-07-20)"} greywall_credentials: {url: "https://docs.greywall.io/greywall/credential-protection", title: "Greywall docs: Credential Protection"} greyhaven_origin_post: {url: "https://greyhaven.co/insights/why-we-built-our-own-sandboxing-system", title: "Greyhaven: Why we built our own sandboxing system"} greywall_github_api: {url: "https://api.github.com/repos/GreyhavenHQ/greywall", title: "GreyhavenHQ/greywall GitHub API metadata (verified 2026-07-20)"} agent_research_2026_07_20: {url: null, title: "Follow-up research triggered by investigating Greywall's stated influences, 2026-07-20 session"} fence_repo: {url: "https://github.com/fencesandbox/fence", title: "Fence README (moved from github.com/Use-Tusk/fence)"} fence_why: {url: "https://github.com/fencesandbox/fence/blob/main/docs/why-fence.md", title: "Fence docs: Why Fence (design philosophy & explicit non-goals)"} fence_architecture: {url: "https://github.com/fencesandbox/fence/blob/main/ARCHITECTURE.md", title: "Fence ARCHITECTURE.md"} fence_agents_docs: {url: "https://github.com/fencesandbox/fence/blob/main/docs/agents.md", title: "Fence docs: supported coding agents"} fence_configuration_docs: {url: "https://github.com/fencesandbox/fence/blob/main/docs/configuration.md", title: "Fence docs: configuration (templates, denied-credential rules)"} fence_github_api: {url: "https://api.github.com/repos/fencesandbox/fence", title: "fencesandbox/fence GitHub API metadata (verified 2026-07-20)"} user_submitted_links_2026_07_20: {url: null, title: "User-submitted URLs (Databricks blog + Omnibox docs), pasted directly in session, 2026-07-20 (not part of the HN thread)"} omnigent_databricks_blog: {url: "https://www.databricks.com/blog/introducing-omnigent-meta-harness-combine-control-and-share-your-agents", title: "Databricks blog: Introducing Omnigent"} omnigent_docs_omnibox: {url: "https://omnigent.ai/docs/omnibox", title: "Omnigent docs: Omnibox"} omnigent_repo: {url: "https://github.com/omnigent-ai/omnigent", title: "omnigent-ai/omnigent README & source (verified 2026-07-20)"} omnigent_github_api: {url: "https://api.github.com/repos/omnigent-ai/omnigent", title: "omnigent-ai/omnigent GitHub API metadata (verified 2026-07-20)"} # ----------------------------------------------------------------------------- # UI hints. The decision funnel keys off documented fields only. # ----------------------------------------------------------------------------- ui: primary_filters: [classification.isolation_boundary, classification.execution_locus, classification.network_policy, classification.credential_mediation, pricing.model, agents_supported, platforms] compare_view_row_order: - classification.isolation_boundary - classification.network_policy - classification.credential_mediation - classification.state_model - risk.stated_scope - risk.assessed_tiers - pricing.model - maturity - limitations evidence_rendering: official: plain text, source-linked thread: chip labeled "per HN commenters", source-linked editorial: chip labeled "our assessment", basis shown on hover/expand toggle_official_only: hide any claim whose effective ev != official decision_funnel: - question: What are you afraid of? maps_to: [risk.stated_scope, risk.assessed_tiers, classification.isolation_boundary] effect: Sets the minimum acceptable boundary strength (taxonomy.isolation_boundary.strength). - question: What will it cost you, in money and machine? maps_to: [pricing, classification.isolation_boundary, footprint_notes] effect: Boundary strength implies local footprint; pricing.model covers the monetary side. - question: Where must code run? maps_to: classification.execution_locus effect: Local ownership vs off-laptop persistence and concurrency. # ----------------------------------------------------------------------------- # Principal sandboxes. Shorthand scalar = {ev: official, src: default_source}. # ----------------------------------------------------------------------------- sandboxes: - id: clawk name: Clawk default_source: clawk_repo tagline: Disposable, network-restricted Linux VMs for coding agents. urls: {repo: "https://github.com/clawkwork/clawk"} license: Apache-2.0 maturity: {value: pre_1_0_active, basis: Repo is pre-1.0 and under active development.} thread_status: {value: directly_linked, src: hn_thread} platforms: value: [macos, linux] basis: macOS first-class; Linux provider explicitly experimental. agents_supported: [claude_code, codex, opencode, generic_command_execution] classification: role: runtime execution_locus: local isolation_boundary: {value: vm, basis: Hypervisor-backed Linux guest per repo or multi-repo worktree.} state_model: {value: resumable, basis: VM disk disposable except snapshots; Linux provider adds disk persistence; repo and conversations live on host.} network_policy: {value: allowlist, basis: Outbound allowlist documented in README.} credential_mediation: {value: forwarded, basis: SSH-agent forwarding keeps private keys off the guest.} risk: stated_scope: value: [t1_accidents, t2_exfiltration, t3_hostile_escape] basis: README claims center on the VM boundary plus network allowlist, while stating that anything mounted or allowlisted is exposed to the agent. assessed_tiers: value: [t1_accidents, t2_exfiltration, t3_hostile_escape] ev: editorial derived_from: [classification.isolation_boundary, classification.network_policy, classification.credential_mediation] basis: Hypervisor boundary (official) + egress allowlist (official) + off-guest keys (official) plausibly cover all three tiers; no independent audit exists. design_intent: value: liberate basis: Product framing is giving agents a disposable VM instead of your laptop. pricing: {model: free_oss} footprint_notes: value: One VM per repo or multi-repo worktree. basis: Documented deployment unit; RAM/disk implications follow from the VM boundary, not from a stored rating. convenience_notes: - {value: Worktree workflow and ticket mode built in.} integrations: [oci_image_rootfs, git_worktrees, ticket_mode, cli] audience: [individual_developer, small_team] limitations: - {value: macOS-first; Linux path experimental.} - {value: Anything mounted or allowlisted is exposed to the agent.} compliance: {value: none_stated} - id: agentjail name: agentjail default_source: agentjail_repo tagline: Policy guardrails that check every agent tool call before it runs. urls: {repo: "https://github.com/LuD1161/agentjail"} license: Apache-2.0 maturity: {value: early_active, basis: "v0.9.0 released 2026-07-16 (Monitor Mode, verified attestation, control-plane auth between daemon/netproxy/secrets-broker); still pre-1.0 and shipping rapidly."} thread_status: {value: directly_linked, src: hn_thread} platforms: [macos, linux] agents_supported: [claude_code, codex, cursor] classification: role: policy_wrapper execution_locus: local isolation_boundary: {value: os_sandbox, basis: Hook-based policy checks with optional kernel sandbox (agentjail-shield).} state_model: {value: resumable, basis: Per-project overlays and sessions; policies and daemon on host.} network_policy: {value: proxy_mediated, basis: Session-aware net proxy; opt-in / interim in some flows.} credential_mediation: value: host_side_injection basis: v0.6+ ships a credential broker and secrets vault; shield path strips ambient env; secrets role mediates access rather than leaving keys ambient in the agent environment. risk: stated_scope: value: [t1_accidents, t2_exfiltration] basis: README frames the goal as preventing unsafe tool calls before they run, with a fail-closed policy posture and defense in depth; it does not claim a VM boundary. assessed_tiers: value: [t1_accidents, t2_exfiltration] ev: editorial derived_from: [classification.isolation_boundary, classification.network_policy, classification.credential_mediation] basis: Policy + OS sandbox + proxy + credential broker address accidents and exfiltration; hostile escape is out of scope without a hypervisor boundary. design_intent: value: constrain basis: Every tool call is checked locally before it runs, per the repo description. pricing: {model: free_oss} footprint_notes: value: Runs as hooks and a host daemon; no VM or container required. basis: Documented architecture. convenience_notes: - {value: Stated goal includes reducing approval fatigue.} integrations: [hooks, opa_policies, mcp_scan, daemon, net_proxy_opt_in, secrets_broker, monitor_mode, control_plane_auth] audience: [individual_developer] limitations: - {value: Not a full VM.} - {value: Proxy path interim / opt-in in some flows.} compliance: {value: none_stated} - id: gondolin name: Gondolin default_source: gondolin_docs tagline: Local microVMs with a programmable (TypeScript) network and filesystem policy layer. urls: {repo: "https://github.com/earendil-works/gondolin", docs: "https://earendil-works.github.io/gondolin/", security: "https://github.com/earendil-works/gondolin/security"} license: {value: Apache-2.0, src: gondolin_repo} maturity: {value: experimental_active, src: gondolin_repo, basis: Self-described as experimental; @earendil-works/gondolin package at v0.12.0 as of mid-2026.} thread_status: {value: directly_linked, src: hn_thread} platforms: [macos, linux] agents_supported: [generic_command_execution, pi] classification: role: runtime execution_locus: local isolation_boundary: {value: microvm, basis: QEMU microVM by default; experimental libkrun backend.} state_model: {value: configurable, basis: Copy-on-write root disk; persistence governed by host-side VFS policy; custom images optional.} network_policy: {value: proxy_mediated, basis: Host-side JS network stack mediates traffic; allowlisting expressible in the policy layer.} credential_mediation: {value: host_side_injection, src: gondolin_repo, basis: Guest sees only a placeholder token; host injects the real secret solely for allowed destinations.} risk: stated_scope: value: [t1_accidents, t2_exfiltration, t3_hostile_escape] src: gondolin_security basis: Security design doc states an explicit threat model, and explicitly trusts the host Node process and QEMU boundary, with no full DoS isolation. assessed_tiers: value: [t1_accidents, t2_exfiltration, t3_hostile_escape] ev: editorial derived_from: [classification.isolation_boundary, classification.network_policy, classification.credential_mediation] basis: MicroVM boundary + mediated egress + host-side secret injection cover all three tiers within the stated trust assumptions. design_intent: value: both ev: editorial basis: Programmable policy layer supports both gating (constrain) and walled autonomy (liberate); docs do not pick a side. pricing: {model: free_oss} footprint_notes: value: MicroVM per sandbox with copy-on-write root disk. basis: Documented architecture. convenience_notes: - {value: Early-stage ergonomics acknowledged in its own docs.} integrations: [typescript_policy_layer, vfs_providers, custom_images, pi_extension] audience: [platform_builder, individual_developer] limitations: - {value: Trusts host Node process and QEMU boundary., src: gondolin_security} - {value: No full DoS isolation., src: gondolin_security} compliance: {value: none_stated} - id: flar name: flar default_source: flar_repo tagline: Fast, light Bubblewrap-based agent restriction with minimal startup overhead. urls: {repo: "https://github.com/swelljoe/flar"} license: Apache-2.0 maturity: {value: very_early, basis: No published releases at fetch time, per its own README.} thread_status: {value: directly_linked, src: hn_thread} platforms: [linux] agents_supported: {value: [claude_code, antigravity, codex, copilot, reasonix, kimi_code], basis: "Kimi Code added via PR #3, merged 2026-07-17."} classification: role: runtime execution_locus: local isolation_boundary: {value: os_sandbox, basis: Bubblewrap in an unprivileged user namespace; read-only system paths; project bind mount.} state_model: {value: resumable, basis: Temporary copied config plus bound per-project transcript stores; host config untouched.} network_policy: {value: configurable, basis: Isolated by default with optional host/shared network.} credential_mediation: {value: mounted, basis: Config is copied in; the chosen agent's credential token remains accessible to that agent.} risk: stated_scope: value: [t1_accidents] basis: README markets tighter-than-in-agent sandboxing but is candid that the project is far less tested and that the agent's own token stays reachable. assessed_tiers: value: [t1_accidents] ev: editorial derived_from: [classification.credential_mediation, classification.isolation_boundary] basis: In-runtime token access undermines the exfiltration tier; OS-sandbox boundary is below hypervisor grade. design_intent: value: constrain basis: A restrictor by name and framing. pricing: {model: free_oss} footprint_notes: value: Namespace-based; minimal startup overhead is the stated point of the project. basis: README framing (Fast Light Agent Restrictor). convenience_notes: - {value: Session seeding / shadow homes; host-side proxy.} integrations: [host_side_proxy, config_copying, session_seeding_shadow_homes] audience: [individual_developer] limitations: - {value: Linux-only.} - {value: "Far less tested, per its own README; no releases at fetch time."} - {value: Agent's own credential token reachable by that agent.} compliance: {value: none_stated} - id: yoloai name: yoloAI default_source: yoloai_repo tagline: One sandbox wrapper across many backends, with a copy/diff/apply review workflow. urls: {repo: "https://github.com/kstenerud/yoloai"} license: MIT maturity: {value: public_beta} thread_status: {value: directly_linked, src: hn_thread} platforms: [linux, macos, windows_wsl2] agents_supported: [claude_code, codex, gemini_cli, aider, opencode, generic_command_execution] classification: role: runtime execution_locus: local isolation_boundary: value: layered basis: Backends span Docker, Podman, containerd/Kata, Apple container, Tart, Seatbelt; isolation modes from namespaces through gVisor to Kata/Firecracker. state_model: {value: copy_apply, basis: Sandbox changes are reviewed with diff and applied; state lives in ~/.yoloai/.} network_policy: {value: configurable, basis: Documented open / allowlist / none modes.} credential_mediation: value: host_side_injection basis: Credential brokering documented, but provider-specific rather than universal; otherwise mounted. risk: stated_scope: value: [t1_accidents, t2_exfiltration] basis: README claims no ambient data, credential brokering, and network none/allowlist modes. assessed_tiers: value: [t1_accidents, t2_exfiltration, t3_hostile_escape] ev: editorial derived_from: [classification.isolation_boundary, classification.network_policy] basis: Tier credibility depends on the chosen backend — namespaces reach t1; Kata/Firecracker backends are t3-grade. design_intent: value: both ev: editorial basis: Copy/diff/apply gates changes (constrain) while backends enable walled autonomy (liberate). pricing: {model: free_oss} footprint_notes: value: Footprint tracks the chosen backend, from shared-kernel namespaces to Firecracker microVMs. basis: Documented backend list. convenience_notes: - {value: Diff/apply adds a review step to every change in exchange for safety., ev: editorial, derived_from: [classification.state_model], basis: Direct implication of the documented copy/diff/apply workflow.} integrations: [go_api, mcp_bidirectional, vscode_tunnel, profiles, extensions] audience: [individual_developer] limitations: - {value: Complexity from many backends., ev: thread, src: hn_thread} - {value: Credential brokering not universal across providers.} compliance: {value: none_stated} - id: virtdev name: virtdev default_source: virtdev_repo tagline: Per-project Arch Linux KVM/QEMU VMs with nftables egress zones. urls: {repo: "https://github.com/matheusmoreira/virtdev"} license: AGPL-3.0 maturity: {value: active_personal_project} thread_status: {value: directly_linked, src: hn_thread} platforms: {value: [linux], basis: "Requires an Arch Linux host specifically, not just any Linux distro."} agents_supported: value: [agent_agnostic, claude_code] basis: "Agent-agnostic in general; Claude Code is mentioned only as a passing example (\"wan is the usual working zone (package managers, Claude Code)\"), not documented as a first-class integration." classification: role: runtime execution_locus: local isolation_boundary: {value: vm, basis: KVM/QEMU virtual machines, locked by default.} state_model: {value: persistent, basis: Shared sealed base image with per-project qcow2 deltas.} network_policy: {value: configurable, basis: nftables egress zones via passt — none/wan/lan/full plus optional custom single-port holes; default zone is none (no network beyond SSH).} credential_mediation: unspecified risk: stated_scope: value: [t1_accidents, t3_hostile_escape] basis: Security focus documented as hypervisor boundary plus egress zones; no built-in policy engine or secret injection yet. assessed_tiers: value: [t1_accidents, t3_hostile_escape] ev: editorial derived_from: [classification.isolation_boundary, classification.network_policy, classification.credential_mediation] basis: Hypervisor boundary and zoning are strong, but with credential handling unspecified, exfiltration protection depends entirely on what the user places in the VM and which zone they choose. design_intent: value: liberate ev: editorial basis: Walled per-project VMs for autonomous work; no per-call gating layer. pricing: {model: free_oss} footprint_notes: value: Full VM per project, deduplicated via a shared sealed base plus qcow2 deltas. basis: Documented storage architecture. convenience_notes: - {value: Root needed at least once to apply the firewall.} integrations: [cli, custom_zones, user_mode_systemd] audience: [linux_power_user] limitations: - {value: Arch-host requirement.} - {value: Credential injection not yet built in.} compliance: {value: none_stated} - id: exe_dev name: exe.dev default_source: exe_dev_site tagline: Hosted persistent Linux VMs that keep working when your laptop is closed. urls: {official: "https://exe.dev/", pricing: "https://exe.dev/pricing", blog: "https://blog.exe.dev/meet-exe.dev"} license: proprietary_service maturity: {value: public_service, basis: Active docs and pricing; developer-preview origins.} thread_status: {value: mentioned_in_report_sources, src: hn_thread} platforms: [browser, ssh, vscode] agents_supported: value: [claude_code, codex, pi, shelley, agent_agnostic] basis: Official Running Agents docs accessed 2026-07-14 state that Claude, Codex, Pi, and Shelley are preinstalled on newly created VMs; other agents can also be installed and run. classification: role: runtime execution_locus: vendor_cloud isolation_boundary: {value: vm, basis: Full hosted Linux VMs with root, apt/systemd, HTTPS proxy, and SSH access.} state_model: {value: persistent, basis: Persistent disks; disks backed up; stopped VMs keep their disk.} network_policy: {value: operator_managed, basis: VMs private by default; access via proxy/SSH; integrations govern reachability.} credential_mediation: value: managed_integration src: exe_dev_docs basis: "Integrations docs describe network-level secret injection that keeps tokens off the VM: GitHub Integration avoids VM-side tokens, AWS/GCP Workload Identity Federation issues short-lived OIDC credentials rather than placing access keys on the VM, and an LLM Gateway removes the need for API keys on the VM." risk: stated_scope: value: [t1_accidents, t3_hostile_escape] basis: Claims include private-by-default access, real VMs, maintained images, and no exposed ports by default. assessed_tiers: value: [t1_accidents, t3_hostile_escape] ev: editorial derived_from: [classification.isolation_boundary, classification.credential_mediation] basis: "Full VM boundary is credible for accidents and hostile escape; exfiltration tier remains unassessed by default because Integrations-mediated credentials (GitHub, AWS/GCP WIF, LLM Gateway) only cover secrets routed through those specific connectors, general VM egress has no documented allowlist/policy, and the vendor sits inside the trust boundary." design_intent: value: liberate ev: editorial basis: Persistent off-laptop VMs for agents to work in unattended. pricing: model: paid_subscription src: exe_dev_pricing notes: {value: Subscription plus usage-based options.} footprint_notes: value: Runs on vendor hardware; local footprint is zero, cost is monetary. basis: Managed-service model. convenience_notes: - {value: "Maintained images; VS Code, regions, GitHub and proxy integrations."} integrations: [ssh_api, https_api, github, http_proxy, llm_integrations, reflection, regions, vscode, agent_skill] audience: [individual_developer, small_team] limitations: - {value: Not self-hostable.} - {value: Region tied per account.} compliance: {value: none_stated_in_fetched_docs} - id: fly_sprites name: Fly.io Sprites default_source: sprites_docs tagline: Persistent, hardware-isolated Firecracker microVM "sandbox computers." urls: {official: "https://sprites.dev/", docs: "https://docs.sprites.dev/"} license: proprietary_service maturity: {value: new_official_product, basis: Docs described as work-in-progress early on.} thread_status: {value: mentioned_only, src: hn_thread} platforms: [api, cli, sdk] agents_supported: value: [agent_agnostic, claude_code, moltbot] basis: "Agent-agnostic generally; Claude Code and Moltbot (Clawdbot) are documented via a dedicated reference-implementation repo and a blog post respectively, not confirmed preinstalled/first-class the way exe.dev documents its agents." classification: role: runtime execution_locus: vendor_cloud isolation_boundary: {value: microvm, basis: Hardware-isolated Firecracker microVMs with private filesystems and networking.} state_model: {value: persistent, basis: Filesystem and memory persist between runs; sleep when idle; checkpoints and restore.} network_policy: value: configurable basis: Outbound is unrestricted by default; an opt-in DNS-based allowlist policy can tighten egress from outside the Sprite. credential_mediation: value: managed_integration basis: Connectors route external API calls through a gateway that holds tokens for the Sprite; not ambient in-guest secrets by default for those paths. General secret handling beyond Connectors is lightly documented. risk: stated_scope: value: [t1_accidents, t3_hostile_escape] basis: Strong isolation claims for arbitrary and user-submitted code; optional DNS egress policy and Connectors for credentialed egress. assessed_tiers: value: [t1_accidents, t3_hostile_escape] ev: editorial derived_from: [classification.isolation_boundary, classification.network_policy] basis: Firecracker boundary covers accidents and hostile escape; default-open egress means t2 is configuration-dependent (apply network policy + Connectors), so it is not assessed by default. design_intent: value: liberate ev: editorial basis: Built as a platform primitive for hosting agent runtimes and untrusted code. pricing: model: paid_usage notes: {value: Usage-based; idle sleep limits standing cost.} footprint_notes: value: Vendor hardware; sleep-when-idle and checkpoint/restore documented. basis: Sprites docs. convenience_notes: - {value: Checkpoint and restore; JS and Go SDKs.} integrations: [cli, rest_api, js_sdk, go_sdk, network_policies, connectors] audience: [platform_builder, individual_developer] limitations: - {value: Managed service only.} - {value: Outbound unrestricted until an egress policy is applied.} - {value: Operational limits and region selection still evolving.} - {value: "https://sprites.dev/ now 301-redirects to https://fly.io/sprites (product fully absorbed into Fly.io's own branding); docs.sprites.dev is unaffected and remains independent.", ev: editorial, basis: Observed 2026-07-20.} compliance: {value: none_stated_in_fetched_docs} - id: agentcage name: agentcage default_source: agentcage_repo tagline: Defense-in-depth sandbox with an inspecting, fail-closed proxy against exfiltration. urls: {repo: "https://github.com/agentcage/agentcage"} license: MIT maturity: {value: experimental, basis: README warns the project is experimental and not audited; many releases.} thread_status: {value: directly_linked, src: hn_thread} platforms: [macos, linux] agents_supported: [claude_code, codex, pi, openclaw] classification: role: runtime execution_locus: local isolation_boundary: value: layered basis: Rootless Podman container, Lima VM, or Apple-container microVM backend, plus internal-only network, inspecting proxy, and DNS sidecar. state_model: {value: ephemeral, basis: Ephemeral sessions tear down but preserve audit logs; persistent cages optional and keep auth.} network_policy: {value: proxy_mediated, basis: Inspecting proxy with fail-closed traffic default.} credential_mediation: {value: host_side_injection, basis: Secret scanning plus placeholder injection with outbound substitution.} risk: stated_scope: value: [t1_accidents, t2_exfiltration] basis: Explicit exfiltration-blocking design — placeholders, fail-closed traffic, audit logs — alongside an explicit not-audited warning. assessed_tiers: value: [t1_accidents, t2_exfiltration] ev: editorial derived_from: [classification.isolation_boundary, classification.credential_mediation] basis: Exfiltration is the design center; escape-tier credibility depends on which backend (container vs VM) is chosen. design_intent: value: constrain basis: Every outbound byte passes an inspecting, fail-closed proxy. pricing: {model: free_oss} footprint_notes: value: Adds proxy and DNS sidecar processes on top of the chosen backend. basis: Documented architecture. convenience_notes: - {value: Operational complexity is the acknowledged trade for depth.} integrations: [cli, scaffolds, custom_inspectors, cage_audit_logs, config_driven_cages] audience: [security_minded_developer, operator] limitations: - {value: Not audited; experimental, per its own README.} compliance: {value: none_stated} - id: instavm_coderunner name: InstaVM CodeRunner default_source: coderunner_repo tagline: Local Apple-container sandbox for AI agents on Apple Silicon, with a cloud path. urls: {repo: "https://github.com/instavm/coderunner", related_blog: "https://instavm.io/blog/nixos-reproducible-dev-environments-on-instavm"} license: Apache-2.0 maturity: {value: active_company_backed} thread_status: {value: directly_linked, src: hn_thread} platforms: value: [macos] basis: "Apple Silicon (M1/M2/M3/M4) specifically — the Apple container runtime requires it; Intel Macs are not supported." agents_supported: {value: [claude_code, agent_agnostic], basis: "Claude Code named explicitly; broader agent support stated without an exact engine list."} classification: role: runtime execution_locus: local isolation_boundary: {value: microvm, basis: Apple container runtime / VM-level isolation.} state_model: value: resumable basis: Documented stop/start preserves uploads, kernels, and installed packages in the same container; delete + reinstall for a clean slate. network_policy: unspecified credential_mediation: unspecified risk: stated_scope: value: [t1_accidents] basis: Claims 100% local execution and zero cloud uploads for local testing; no documented network or credential posture. assessed_tiers: value: [t1_accidents, t3_hostile_escape] ev: editorial derived_from: [classification.isolation_boundary] basis: VM-level isolation supports containment tiers, but exfiltration credibility cannot be assessed with network and credential posture unspecified. design_intent: value: liberate ev: editorial basis: A box to run agents in, not a per-call gate. pricing: {model: free_oss} footprint_notes: value: Apple-container VM per sandbox on Apple Silicon. basis: Documented runtime. convenience_notes: [] integrations: [coderunner_ui, instavm_ecosystem, cloud_compatible_workflow, mcp_server] audience: [mac_developer] limitations: - {value: Apple-centric.} - {value: Fetched sources light on network and credential policy detail., ev: editorial, basis: Comparative observation across this dataset's entries.} compliance: {value: none_stated} - id: yolobox name: yolobox default_source: yolobox_repo tagline: Let the agent work freely inside a container; keep your home directory out of it. urls: {repo: "https://github.com/finbarr/yolobox"} license: MIT maturity: {value: active_0x} thread_status: {value: directly_linked, src: hn_thread} platforms: [macos, linux] agents_supported: value: [claude_code, codex, kimi_code, gemini_cli, antigravity, opencode, copilot, pi, agent_agnostic] basis: First-class CLI shortcuts documented for Claude, Codex, Kimi Code, Gemini, Antigravity, OpenCode, Copilot, and Pi (Claude/Codex/Kimi Code get built-in yolobox guidance); shell/run cover other harnesses. classification: role: runtime execution_locus: local isolation_boundary: {value: container, basis: Container-based; agent gets sudo inside the container.} state_model: {value: persistent, basis: Named volumes preserve setup across sessions.} network_policy: {value: open, basis: Open network by default; --no-network available per command.} credential_mediation: {value: mounted, basis: "Passed-in secrets are exposed to the agent, per its own security notes."} risk: stated_scope: value: [t1_accidents] basis: README is explicit that it protects against accidents more than hostile-code escape, and recommends rootless Podman or a VM for tighter threat models. assessed_tiers: value: [t1_accidents] ev: editorial derived_from: [risk.stated_scope] basis: Matches the vendor's own honest scoping; no reason to assess beyond it. design_intent: value: liberate basis: The product's framing is letting the agent run freely inside the box. pricing: {model: free_oss} footprint_notes: value: Single shared-kernel container with named volumes. basis: Documented architecture. convenience_notes: - {value: One-command ergonomics with hardening options documented.} integrations: [cli_flags, hardening_options, security_model_docs] audience: [individual_developer] limitations: - {value: Not positioned as a strong escape barrier.} - {value: Project dir and passed-in secrets remain exposed.} - {value: Open network by default.} compliance: {value: none_stated} - id: bitrise_rde name: Bitrise Remote Dev Environments default_source: bitrise_rde tagline: Hosted isolated VMs (macOS and Linux) for remote dev and agent sessions on CI infrastructure. urls: {official: "https://bitrise.io/platform/remote-dev-environments"} license: proprietary_service maturity: {value: beta, basis: Product page positions RDE as in beta with free trial / talk-to-us packaging.} thread_status: {value: directly_linked, src: hn_thread} platforms: {value: [macos, linux], basis: "Vendor-hosted macOS and Linux cloud environments on Bitrise CI stacks — hosting model is already captured by classification.execution_locus: vendor_cloud; these ids denote OS only."} agents_supported: {value: [claude_code, codex, gemini_cli, mcp_orchestrated], basis: "Product page lists Claude Code, Codex, Gemini CLI, and MCP-orchestrated agents among supported tools."} classification: role: remote_workspace execution_locus: vendor_cloud isolation_boundary: {value: vm, basis: Cloud VMs on the same stacks/caches as Bitrise CI; one machine per task.} state_model: {value: persistent, basis: Persistent on-demand VMs; sessions can be archived and restored.} network_policy: operator_managed credential_mediation: value: unspecified basis: Product page says credentials are scoped to the session and agents use user-supplied API keys; that is lifetime/scope control, not documented mediation that keeps secrets off the guest (managed_integration). risk: stated_scope: value: [t1_accidents, t3_hostile_escape] basis: Security framing emphasizes per-session isolation and the same posture as Bitrise CI infrastructure; public page does not document egress or host-side secret injection for agents. assessed_tiers: value: [t1_accidents, t3_hostile_escape] ev: editorial derived_from: [classification.isolation_boundary, classification.credential_mediation] basis: VM isolation is credible for accidents and hostile escape; t2 left unasserted because session-scoped keys still land with the agent and egress control is not documented on the public page; vendor sits inside the trust boundary. design_intent: value: liberate ev: editorial basis: Off-laptop machines for agents to work in, one per task. pricing: model: contact_sales notes: {value: Product page offers free trial and says talk-to-us for fit; packaging still in flux during beta.} footprint_notes: value: Vendor hardware, including cloud macOS — rare in this space. basis: Product page. convenience_notes: - {value: SSH, VNC, web terminal, VS Code plugin, MCP server, API.} integrations: [cli, web_ui, mcp_server, api, vscode_plugin, ssh, vnc, web_terminal] audience: [team, mobile_team, enterprise] limitations: - {value: Pricing/packaging moving during beta.} - {value: No self-hosted RDE equivalent surfaced., ev: editorial, basis: Not found in fetched sources; Bitrise supports on-prem runners for builds generally.} compliance: {value: none_stated_for_rde_specifically} - id: github_codespaces name: GitHub Codespaces default_source: codespaces_docs tagline: Hosted VM + devcontainer dev environments, commonly repurposed as agent sandboxes. urls: {official: "https://github.com/features/codespaces"} license: proprietary_service maturity: {value: mature_ga} thread_status: {value: directly_linked, src: hn_thread} platforms: [browser, vscode] agents_supported: [agent_agnostic] classification: role: remote_workspace execution_locus: vendor_cloud isolation_boundary: {value: layered, basis: Development container hosted on a VM; isolated virtual network per codespace.} state_model: {value: persistent, basis: Saved changes persist across stops; 30-minute idle timeout default; inactive stopped codespaces delete after 30 days by default, configurable.} network_policy: {value: open, basis: Outbound internet allowed by default.} credential_mediation: {value: unspecified, basis: Standard GitHub secrets model; no agent-native mediation story documented.} risk: stated_scope: value: [t1_accidents] basis: Official docs claim isolated virtual networking and enterprise auditability; positioning is dev environments, not agent safety. assessed_tiers: value: [t1_accidents, t3_hostile_escape] ev: editorial derived_from: [classification.isolation_boundary, classification.network_policy] basis: The VM contains damage to the codespace, but open outbound by default and no agent-native secret mediation leave the exfiltration tier unaddressed. design_intent: value: liberate ev: editorial basis: A general dev environment repurposed as a wall, with no agent gating layer. pricing: model: free_tier_plus_usage notes: {value: Free allowance for individuals, then pay-as-you-go.} footprint_notes: value: Vendor hardware; prebuilds shorten startup at extra cost. basis: Codespaces docs. convenience_notes: - {value: "Devcontainer features, prebuilds, browser and VS Code access."} integrations: [rest_api, vscode, browser, devcontainer_features, prebuilds, octokit] audience: [individual_developer, team, enterprise] limitations: - {value: Not self-hostable.} - {value: Outbound internet allowed by default.} - {value: "Isolation is dev-environment-grade, not agent-specific safety control.", ev: editorial, derived_from: [classification.network_policy, classification.credential_mediation], basis: "No egress policy or credential mediation aimed at agent threat models."} compliance: {value: inherits_github_enterprise_posture} - id: claude_code_sandbox name: Claude Code sandbox default_source: claude_code_sandbox_docs tagline: OS-native sandboxing built into Claude Code for safer autonomy with fewer prompts. urls: {docs: "https://code.claude.com/docs/en/sandboxing", engineering: "https://www.anthropic.com/engineering/claude-code-sandboxing", containment: "https://www.anthropic.com/engineering/how-we-contain-claude"} license: product_feature maturity: value: mature_no_beta_label ev: editorial basis: "As of 2026-07-20, the current canonical docs (code.claude.com/docs/en/sandboxing) no longer label the built-in sandboxed Bash tool beta or research preview; that label now applies only to the separate, standalone @anthropic-ai/sandbox-runtime package (which wraps the whole Claude Code process, not just Bash). The 2026 engineering post's beta wording described that earlier, narrower rollout. Anthropic does not explicitly call the built-in tool GA either — this is an absence of a beta label, not a confirmed GA announcement. Cross-checked independently via codex CLI, which reached the same conclusion." thread_status: {value: directly_linked, src: hn_thread} platforms: {value: [macos, linux, windows_wsl2], basis: "Seatbelt on macOS; Bubblewrap on both Linux and WSL2. WSL1 and native Windows are not supported."} agents_supported: [claude_code] classification: role: runtime_feature execution_locus: local isolation_boundary: {value: os_sandbox, basis: "OS-native filesystem and network sandboxing — Seatbelt on macOS, Bubblewrap on Linux and WSL2."} state_model: {value: persistent, basis: Local repo/workspace state persists; sandbox applies to bash commands and FS/network boundaries.} network_policy: {value: configurable, basis: Sandbox-configured network boundaries.} credential_mediation: value: ambient basis: "Sandboxed Bash commands inherit the parent process environment by default, including any credentials set there — the default read policy also still allows reading files like ~/.aws/credentials or ~/.ssh/. The optional sandbox.credentials setting can `deny` reads/unset specific env vars, or `mask` an env var behind a sentinel value that a TLS-terminating egress proxy substitutes for the real secret only on requests to allowed hosts — but neither is the default, and there is no OS keyring/keychain-based mediation of secrets by the sandbox feature itself (that mechanism does not appear in the current docs; it does not exist). Independently confirmed via codex CLI." risk: stated_scope: value: [t1_accidents, t2_exfiltration] basis: Anthropic ties sandboxing to working-directory boundaries, network controls, and reduced permission prompts. assessed_tiers: value: [t1_accidents, t2_exfiltration] ev: editorial derived_from: [classification.isolation_boundary, classification.network_policy] basis: "OS sandbox plus default-deny-then-prompt network controls address accidents and exfiltration; not a hypervisor boundary. Credentials are ambient by default (ambient env inheritance, deny/mask are opt-in), so this tier's credibility rests on the network boundary and user-configured sandbox.credentials rules, not on any built-in credential mediation." design_intent: value: both basis: Stated goal is safer autonomy with fewer permission prompts — gating and liberation together. pricing: {model: product_feature, notes: {value: Bundled with Claude Code; product pricing not in fetched sources.}} footprint_notes: value: OS-sandbox primitives; no VM or container overhead. basis: Documented mechanism. convenience_notes: - {value: "Reduces permission prompts, per Anthropic's stated design goal."} - {value: Zero-install for existing Claude Code users., ev: editorial, basis: It is a feature of the product the user already runs.} integrations: [ide_integrations, permissions_system, devcontainer_guidance, agent_sdk, managed_agents_docs] audience: [claude_code_users] compliance: value: not_referenced_in_these_sources_trust_center_exists_separately ev: editorial src: anthropic_containment basis: "Neither cited engineering post references any active trust-center certification for this specific sandbox feature (no SOC 2, ISO 27001, etc). The containment post's only certification-adjacent mention is ISO/IEC 42001, named in a forward-looking \"Looking ahead\" section as an external AI-management standard the industry should develop toward, not something claimed as already held. This is scoped to these two posts only: Anthropic does maintain a separate Trust Center (trust.anthropic.com) documenting an actual SOC 2 Type II report and ISO 27001 certificate at the company level, per code.claude.com/docs/en/security — that just isn't what these two engineering posts discuss. Independently confirmed via codex CLI, grok CLI, and direct fetches of all sources." limitations: - {value: Relies on the user approval model outside the sandbox.} - {value: Boundaries must be configured correctly.} - id: codex_sandbox name: Codex sandbox default_source: codex_security tagline: OS-native local sandboxing plus worktree and isolated cloud execution modes. urls: {docs: "https://learn.chatgpt.com/docs/sandboxing?surface=app", security: "https://learn.chatgpt.com/docs/agent-approvals-security"} license: product_feature maturity: {value: mature_product_docs} thread_status: {value: directly_linked, src: hn_thread} platforms: {value: [macos, linux, windows_wsl2, windows_powershell, cloud], basis: "Seatbelt on macOS, Bubblewrap on Linux/WSL, native Windows sandbox on PowerShell; cloud tasks in isolated cloud environments."} agents_supported: [codex] classification: role: runtime_feature execution_locus: {value: hybrid, basis: "Local, worktree, and cloud execution modes documented."} isolation_boundary: {value: os_sandbox, basis: OS-native sandboxing locally; isolated cloud environments for cloud tasks.} state_model: {value: configurable, basis: Local and worktree tasks run on your machine; cloud tasks run remotely; boundaries govern write scope.} network_policy: {value: configurable, basis: Default network off locally; managed network policy in enterprise guidance.} credential_mediation: value: unspecified basis: "The cited sandboxing and agent-approvals-security docs describe filesystem/network boundaries and approvals, but no sandbox-specific credential mediation mechanism. Codex's `cli_auth_credentials_store` config (auth.json vs OS keychain) governs where the CLI caches its OWN login credentials — that is unrelated to how the local sandbox mediates a project's secrets. Independently confirmed via codex CLI." risk: stated_scope: value: [t1_accidents, t2_exfiltration] basis: OpenAI documents sandboxing, approvals, network policies, and agent-native telemetry / audit trails. assessed_tiers: value: [t1_accidents, t2_exfiltration] ev: editorial derived_from: [classification.network_policy] basis: Default-off local network is a notably conservative exfiltration posture on its own; the local boundary remains OS-sandbox-grade rather than hypervisor-grade, and no sandbox-specific credential mediation is documented. design_intent: value: both basis: Approvals model (constrain) combined with sandboxed autonomous modes (liberate). pricing: {model: product_feature, notes: {value: Varies by surface; not in fetched sources.}} footprint_notes: value: OS-sandbox primitives locally; cloud tasks offloaded to vendor hardware. basis: Documented modes. convenience_notes: - {value: Native Windows sandbox support — rare in this space., ev: editorial, derived_from: [platforms], basis: Comparative observation across this dataset's entries.} integrations: [chatgpt_desktop, cli, ide_extension, sdk, app_server, mcp_server, github_action, third_party] audience: [individual_developer, team, enterprise] limitations: - {value: Pricing and some operational details vary by surface.} - {value: User must still choose a permissions posture.} compliance: {value: enterprise_guidance_documented} - id: byre name: byre default_source: byre_repo tagline: "Your favourite skills and creature comforts in a constrained agent environment around any folder" urls: {repo: "https://github.com/pjlsergeant/byre", docs: "https://getbyre.com/docs"} license: MIT maturity: value: young basis: "v1.1.0 released 2026-07-19. Its own README: \"byre is a young project. I spend all day, every day inside it\" and \"all the major planned features have been added, so the interface should be pretty stable at this point.\"" thread_status: {value: directly_linked, src: hn_thread} platforms: [linux, macos] agents_supported: value: [claude_code, codex, gemini_cli, grok, opencode] basis: Bundled agent skills ship for Claude Code, Codex, Gemini, Grok, and OpenCode. classification: role: runtime execution_locus: local isolation_boundary: value: container basis: "Local container via Docker or Podman (rootful or rootless), Debian-derived base images; current folder mounted read-write into /workspace. README: \"Not a security product: a container is not a microVM.\"" state_model: value: persistent basis: Per-project state and cache volumes persist across rebuilds; agent logins persist per project, with an opt-in machine-wide shared-auth mode available at first run. network_policy: value: configurable basis: Open by default; the firewall skill flips to deny-by-default with an allowlist, and the firewall-open skill keeps network open while selectively blocking named hosts (egress = ["!host"]). credential_mediation: {value: mounted, basis: "Project mounted read-write; credentials passed through, with an opt-in shared-auth mode across projects."} risk: stated_scope: value: [t1_accidents] basis: "README explicitly says it is not a security product, that containers are not microVMs, and that protections exist \"from over-eager and reckless agents, not from state-sponsored malware\" — and are \"one config edit away from off.\"" assessed_tiers: value: [t1_accidents] ev: editorial derived_from: [risk.stated_scope] basis: Matches the vendor's own honest scoping. design_intent: value: liberate ev: editorial basis: An ergonomic, comfortable box for agents, with transparency rather than gating as the differentiator. pricing: {model: free_oss} footprint_notes: value: Shared-kernel container per project; generated Dockerfiles keep lock-in low, with exit hatches (`byre dockerfile`, `byre dockerrun`) for leaving byre entirely. basis: Documented architecture. convenience_notes: - {value: "Interactive TUI config editor; TOML config layering (personal, template, shared, per-project); reusable templates (Go, Node, Python) and skills; `byre worktree` for linked git worktrees with separate boxed sessions; `byre deliver`/`byre grab` for bidirectional file transfer; MCP server support (`byre mcp add`); shippable `byre.preset` files."} integrations: [tui, toml_layering, generated_dockerfiles, templates, skills, mcp_server, worktrees, file_delivery, presets] audience: [individual_developer] limitations: - {value: Network open by default unless the firewall skill is enabled.} - {value: Project mounted read-write.} - {value: Explicitly not an escape barrier, per its own README.} - {value: Debian-derived base images only.} compliance: {value: none_stated} - id: aide name: aide default_source: aide_repo tagline: One-command agent launcher with OS-native sandboxing, capability grants, and SOPS secrets. urls: {repo: "https://github.com/jskswamy/aide/"} license: MIT maturity: {value: early_active, basis: Actively released OSS with CI and sandbox docs; still evolving.} thread_status: {value: directly_linked, src: hn_thread} platforms: [macos, linux] agents_supported: value: [claude_code, codex, aider, agent_agnostic] basis: Unified launcher resolves whichever agent is configured or on PATH; Claude, Codex, and Aider cited in README examples. classification: role: runtime execution_locus: local isolation_boundary: value: os_sandbox basis: Platform-native enforcer — macOS Seatbelt or Linux Landlock (bubblewrap fallback for filesystem isolation when Landlock is unavailable). state_model: {value: persistent, basis: Host workspace and config; agent runs against the local project under sandbox rules rather than a disposable guest disk.} network_policy: value: open basis: Default code-only mode allows network outbound while locking sensitive host paths; no default-deny egress allowlist. credential_mediation: value: mounted basis: SOPS/age secrets decrypt in-process (not left as plaintext on disk); capability flags unlock specific host credential paths (AWS, docker, kubeconfig, etc.) into the sandbox. risk: stated_scope: value: [t1_accidents, t2_exfiltration] basis: README positions code-only guards against touching SSH keys, cloud credentials, and browser data while still allowing code work and network; not a hypervisor boundary. assessed_tiers: value: [t1_accidents, t2_exfiltration] ev: editorial derived_from: [classification.isolation_boundary, classification.credential_mediation] basis: OS sandbox plus capability-gated credentials address accidents and opportunistic exfiltration; hostile escape remains OS-sandbox-grade, not microVM/VM-grade. design_intent: value: both basis: Constrain via never-allow / capability walls; liberate via fewer permission prompts inside the approved envelope. pricing: {model: free_oss} footprint_notes: value: OS-sandbox primitives around the agent process; no VM or container required. basis: Documented Seatbelt / Landlock / bubblewrap path. convenience_notes: - {value: YAML project config with trust gate; one command across agents.} - {value: "Capability bundles (docker, k8s, aws, …) instead of hand-written path rules."} integrations: [cli, aide_yaml, sops_age_secrets, capabilities, mcp] audience: [individual_developer, team] limitations: - {value: "Shared-kernel OS sandbox, not a microVM or full VM."} - {value: Network open in default code-only mode.} - {value: Unlocked capabilities intentionally expose the corresponding credentials to the agent.} compliance: {value: none_stated} - id: nono name: nono default_source: nono_repo tagline: Kernel-enforced OS sandbox (Landlock/seccomp/Seatbelt) with a credential proxy for terminal coding agents. urls: {official: "https://nono.sh/", repo: "https://github.com/nolabs-ai/nono", docs: "https://nono.sh/docs/llms.txt"} license: Apache-2.0 maturity: value: pre_1_0_active basis: v0.68.0 as of July 2026 with 100 GitHub releases (102 tags); README states "In the lead-up to a 1.0 release, APIs are stabilizing." thread_status: value: not_from_hn_thread src: user_email_2026_07_20 basis: Added 2026-07-20 from a user-submitted recommendation (private email), independent of the source HN thread; the user described it as their current setup on top of a plain container dev env. platforms: value: [macos, linux, windows_wsl2] basis: Explicitly supports macOS, Linux (Debian/Ubuntu, Fedora, Arch, RHEL, openSUSE, Nix), and Windows via WSL2, with a documented WSL2 feature-compatibility matrix. agents_supported: value: [claude_code, opencode, codex, antigravity, goose, openclaw, copilot, qwen_code, pi, hermes] src: nono_site basis: Site states it "sandboxes any terminal agent" and names these explicitly. classification: role: runtime execution_locus: local isolation_boundary: value: os_sandbox basis: README states "no daemon, no container, no VM, and no disk space usage"; uses Linux Landlock layered with seccomp-notify, and Apple's Seatbelt sandbox on macOS. state_model: value: persistent basis: Runs directly against the host project (no separate VM/container disk); capability sets can be serialized/restored as JSON, and atomic rollbacks use content-addressable filesystem snapshots. network_policy: value: configurable basis: "Domain-level (L7) allow-list filtering and proxy modes; docs confirm the pre-configuration default is actually open — unrestricted network access — with default-deny/allow-listing only taking effect once `--allow-domain`/`--network-profile` is explicitly set." credential_mediation: value: host_side_injection src: nono_docs basis: "Site states secrets \"are injected at the boundary and never exposed to the agent\" and \"zeroised on exit\"; supports proxy-based injection (true host-side, opt-in via `--credential`) from OS keystore, 1Password, Bitwarden, Apple Passwords, files, or env, plus sandboxed OAuth logins where the agent only ever sees a phantom token. A second, less-safe mode (`--env-credential`) exposes the secret directly in the sandboxed process's environment instead — neither mode is the default; the user must opt into one." risk: stated_scope: value: [t1_accidents, t2_exfiltration] basis: Marketing centers on capability-based least privilege, irrevocable OS-level allow-lists, a credential proxy that keeps real secrets off the agent process, and a tamper-evident audit trail; it does not make an explicit hypervisor-grade escape claim. assessed_tiers: value: [t1_accidents, t2_exfiltration] ev: editorial derived_from: [classification.isolation_boundary, classification.network_policy, classification.credential_mediation] basis: Landlock/seccomp/Seatbelt is OS-sandbox-grade, not microVM/VM-grade, so it is assessed like this dataset's other os_sandbox entries (aide, flar) — credible for accidents and exfiltration, not for hostile-code escape. design_intent: value: constrain basis: Framing centers on capability-based least privilege, irrevocable allow-lists, and audit trails — gating agent actions rather than open-ended autonomy. pricing: model: free_oss notes: {value: "Core CLI is Apache-2.0 OSS; a dedicated pricing page returned 404 at audit time (2026-07-20), so a possible paid/hosted tier is unconfirmed."} footprint_notes: value: No daemon, container, or VM disk usage — kernel primitives applied directly to the agent process. basis: README's own framing ("no daemon, no container, no VM, and no disk space usage"). convenience_notes: - {value: OAuth logins run inside the sandbox using phantom tokens; capability sets are serializable to JSON for reuse across sessions.} integrations: [cli, credential_proxy, oauth_phantom_tokens, capability_sets_json, os_keystore_integrations] audience: [individual_developer, security_minded_developer] limitations: - {value: Pre-1.0; APIs still stabilizing, per its own docs.} - {value: "OS-sandbox boundary (Landlock/seccomp/Seatbelt), not hypervisor-grade."} - {value: Windows support is WSL2-only with documented feature gaps.} compliance: {value: none_stated} - id: leash name: Leash (strongDM) default_source: leash_repo tagline: Cedar-policy-enforced container wrapper for coding agents, with filesystem/network/MCP-call monitoring. urls: {repo: "https://github.com/strongdm/leash"} license: Apache-2.0 maturity: {value: early_active, basis: "9 releases, latest v1.1.7 as of March 2026; 581 GitHub stars; active development."} thread_status: value: not_from_hn_thread src: user_email_2026_07_20 basis: Added 2026-07-20 from a user-submitted recommendation (private email); the user reported starting here before nono.sh but moving off it because spinning it up per git worktree was too slow for their workflow. platforms: value: [macos, linux, windows_wsl2] basis: "README states support for \"macOS or Linux (WSL, too!)\"; ships a native macOS helper app for an experimental monitoring mode." agents_supported: value: [claude_code, codex, gemini_cli, qwen_code, opencode] basis: Built-in agent images ship for claude, codex, gemini, qwen, and opencode via the default coder image; extensible to custom images. classification: role: policy_wrapper execution_locus: local isolation_boundary: {value: container, basis: Wraps agents in Docker/Podman containers with syscall-level activity monitoring.} state_model: unspecified network_policy: value: configurable basis: "Cedar policy files can restrict which network connections the containerized agent may initiate, and full monitoring mode logs every connection made — but a policy is opt-in (`--policy` is an optional flag); primary sources do not document a deny-by-default network posture with no policy supplied." credential_mediation: value: mounted basis: "Environment forwarding automatically maps provider API keys (ANTHROPIC_API_KEY, OPENAI_API_KEY, GEMINI_API_KEY, DASHSCOPE_API_KEY) into the container; mount prompts let users approve credential forwarding with persistent decisions, and agent config directories such as ~/.codex can be bind-mounted read-write into the container per docs/CONFIG.md — keys and configs land inside the container rather than being proxied at the boundary." risk: stated_scope: value: [t1_accidents] basis: README frames Leash as wrapping agents in containers and monitoring every filesystem access and network connection, with Cedar policy enforcement and MCP tool-call inspection; it documents monitoring and optional policy enforcement, not a default-deny egress posture, so it does not itself claim exfiltration-tier containment out of the box. assessed_tiers: value: [t1_accidents] ev: editorial derived_from: [classification.isolation_boundary, classification.network_policy, classification.credential_mediation] basis: Container boundary supports accident containment. Exfiltration-tier credit requires a restrictive network policy to be in effect, but network policy here is opt-in rather than default-deny, and provider credentials plus agent config directories can be mounted read-write into the container — so t2_exfiltration is not assessed without the operator configuring a Cedar policy themselves. Hostile-code escape is out of scope without a hypervisor/microVM boundary. design_intent: value: constrain basis: Cedar policy rules gate filesystem, network, and MCP tool calls while the agent runs. pricing: {model: free_oss} footprint_notes: value: Two containers per session (an agent container plus a Leash manager container) via Docker/Podman; native macOS helper app adds an experimental monitoring mode. basis: "README's Key Concepts section documents an agent container plus a manager container, with env vars forwarded into both." convenience_notes: - {value: "Default coder image ships ready-to-run agent CLIs (claude, codex, gemini, qwen, opencode); install via npm, Homebrew (macOS), or prebuilt binaries."} integrations: [cli, npm, homebrew, cedar_policies, mcp_inspection, docker, podman] audience: [individual_developer] limitations: - {value: "Its own DISCLAIMER.txt provides no warranty and states \"no support or maintenance is provided. Use is at your own risk,\" with no further security scoping.", src: leash_disclaimer} - {value: Provider API keys are forwarded into the container rather than proxied at the boundary.} - {value: One user reported per-worktree spin-up was slow enough to prompt switching to a different tool; not vendor-documented or independently benchmarked., ev: editorial, src: user_email_2026_07_20} compliance: {value: none_stated} - id: greywall name: Greywall default_source: greywall_repo tagline: Container-free, deny-by-default OS sandbox with kernel-level transparent network capture and host-side credential substitution. urls: {official: "https://greywall.io/", repo: "https://github.com/GreyhavenHQ/greywall", docs: "https://docs.greywall.io/greywall"} license: Apache-2.0 maturity: value: pre_1_0_active src: greywall_github_api basis: "v0.3.7 as of 2026-06-01 (verified via GitHub API, not just marketing copy); 271 GitHub stars; repo created 2026-03-04, last pushed 2026-06-11 -- roughly six weeks stale relative to this audit." thread_status: value: not_from_hn_thread src: user_email_2026_07_20 basis: Added 2026-07-20 from a user-submitted recommendation, independent of the source HN thread. platforms: value: [linux, macos] basis: "Linux gets the full five-layer stack (bubblewrap, Landlock, seccomp-BPF, eBPF monitoring, TUN-based transparent network capture); macOS uses sandbox-exec (Seatbelt) with no transparent network capture -- network mediation there falls back to proxy-env-var cooperation only, a materially weaker exfiltration boundary than Linux's." agents_supported: value: [claude_code, codex, cursor, aider, goose, gemini_cli, opencode, copilot, pi] src: greywall_agent_profiles_tree basis: "Repo's internal/profiles/agents tree ships 14 built-in profiles: these 9 plus Amp, Cline, Kilo, Auggie, and Droid, none of which have ids in this dataset's closed agents_supported taxonomy; recorded here rather than expanding the taxonomy per-agent." classification: role: runtime execution_locus: local isolation_boundary: value: os_sandbox basis: "Bubblewrap namespacing + Landlock + seccomp-BPF + eBPF violation monitoring on Linux, Seatbelt on macOS -- all OS-primitive boundaries, not a container/VM backend, so classified like nono rather than as `layered`." state_model: value: persistent basis: Runs directly against the host project via OS primitives; no separate container/VM disk to reset. network_policy: value: proxy_mediated basis: "Default-deny; all traffic routed through greyproxy (SOCKS5, local dashboard). On Linux this is enforced via kernel-level TUN capture so it also catches binaries that ignore proxy env vars -- the explicit reason Greyhaven built this instead of adopting Fence (see limitations). `--watch` mode inverts to allow-by-default for observability while keeping proxy visibility." credential_mediation: value: host_side_injection src: greywall_credentials basis: "Credential substitution is on by default: env vars matching known secret patterns are replaced with an opaque placeholder token in the sandboxed process; greyproxy substitutes the real value only at egress, so the agent process never holds the real key. `.env` handling differs by platform: on Linux a rewritten placeholder copy is bind-mounted read-only over the original (readable, but fake, without breaking tools that expect the file to exist); on macOS Seatbelt can't redirect a read to a different file, so `.env` is denied outright instead. SSH keys and git hooks are denied on both. Disableable via --no-credential-protection." risk: stated_scope: value: [t1_accidents, t2_exfiltration] basis: "Marketing and docs center on accidental destructive commands, credential exposure via .env/secrets, and network exfiltration (blocking egress to arbitrary domains, including from binaries that bypass proxy env vars); five kernel-enforced layers are also framed as blocking dangerous syscalls, but no hypervisor-grade escape claim is made." assessed_tiers: value: [t1_accidents, t2_exfiltration] ev: editorial derived_from: [classification.isolation_boundary, classification.network_policy, classification.credential_mediation] basis: "OS-sandbox boundary (bubblewrap/Landlock/seccomp/Seatbelt) is assessed like this dataset's other os_sandbox entries (nono, aide, flar) -- credible for accidents and exfiltration given the proxy-mediated network default and host-side credential injection, not for hostile-code escape without a hypervisor/microVM boundary. On macOS specifically, the weaker (env-var-only) network mediation makes the exfiltration assessment less confident than on Linux." design_intent: value: constrain basis: Framing centers on deny-by-default gating of filesystem, network, and syscall access, plus live observability of what the agent touches. pricing: model: free_oss notes: {value: "Core tool is Apache-2.0 OSS; site mentions a team-wide \"managed governance layer\" as coming soon, no pricing published."} footprint_notes: value: Container-free -- OS primitives (bubblewrap/Landlock/seccomp/Seatbelt) applied directly to the wrapped process, no image builds or container/VM disk. basis: "Built explicitly to avoid the image-rebuild friction of Greyhaven's earlier Docker-based tool (Cubbi), per their own origin writeup." convenience_notes: - {value: "Learning mode traces filesystem access (strace on Linux, eslogger on macOS) while running a command permissively, then auto-generates a least-privilege profile; ships built-in profiles for common toolchains (Node, Python, Go, Rust, Java, Ruby, Docker) layerable via --profile."} integrations: [cli, homebrew, go_install, mise, socks5_proxy, dashboard] audience: [individual_developer, security_minded_developer] limitations: - {value: "Pre-1.0; repo last pushed 2026-06-11, about six weeks stale relative to this audit.", src: greywall_github_api} - {value: "OS-sandbox boundary (bubblewrap/Landlock/seccomp/Seatbelt), not hypervisor-grade."} - {value: "macOS lacks Linux's kernel-level TUN network capture -- network mediation there depends on the process cooperating with proxy env vars. Greyhaven's own origin post cites exactly this class of gap (proxy-cooperation dependence) in Fence, a prior project they evaluated, as their stated reason for building Greywall instead; per the separate fence entry, Fence's current default policy is actually kernel-enforced on both platforms except in specific fallback/relaxed configurations, so treat this as Greyhaven's historical framing rather than a live comparison of the two tools' current behavior.", src: greyhaven_origin_post} - {value: "14 built-in agent profiles, but 5 (Amp, Cline, Kilo, Auggie, Droid) have no id in this dataset's closed agents_supported taxonomy and aren't represented in that field.", ev: editorial, basis: "Counted directly from the repo's internal/profiles/agents directory listing (14 files) against this dataset's closed taxonomy.agents_supported list; the gap is this dataset's classification limitation, not something Greywall's own docs state."} compliance: {value: none_stated} - id: fence name: Fence default_source: fence_repo tagline: Lightweight, container-free OS sandbox with per-agent config templates; the project Greywall's authors evaluated and moved away from. urls: {official: "https://fencesandbox.com/", repo: "https://github.com/fencesandbox/fence", docs: "https://github.com/fencesandbox/fence/blob/main/docs/README.md"} license: Apache-2.0 maturity: value: pre_1_0_active src: fence_github_api basis: "v0.1.63 as of 2026-07-19 (verified via GitHub API); 859 GitHub stars; 64 releases; repo created 2025-12-18 and pushed as recently as the day before this audit -- markedly more active than Greywall's six-week-stale push. Moved orgs from github.com/Use-Tusk/fence to github.com/fencesandbox/fence; the old org's API path 301-redirects to the same repository via GitHub's repo-id endpoint, i.e. a tracked rename, not a dead/abandoned repo." thread_status: value: not_from_hn_thread src: agent_research_2026_07_20 basis: "Investigated 2026-07-20 after Greywall's own origin post (see the greywall entry's limitations) named Fence as a prior project Greyhaven evaluated before building their own tool; not part of this dataset's primary Clawk HN thread." platforms: value: [macos, linux, windows_wsl2] basis: "macOS via sandbox-exec (Seatbelt); Linux via bubblewrap+seccomp+Landlock; Windows only via the Nix install method running under WSL, per its own install docs -- no native Windows support documented." agents_supported: value: [claude_code, codex, gemini_cli, copilot, cursor, opencode, pi] src: fence_agents_docs basis: "docs/agents.md documents template support for these plus Amp, Droid, and Crush, none of which have ids in this dataset's closed agents_supported taxonomy (same gap noted on the greywall entry); Cursor needs the code-relaxed template specifically because its Node/undici HTTP client doesn't respect HTTP_PROXY." classification: role: runtime execution_locus: local isolation_boundary: value: os_sandbox basis: "sandbox-exec on macOS, bubblewrap+seccomp+Landlock on Linux -- OS-primitive boundaries, no container/VM backend, classified like nono/greywall rather than as `layered`." state_model: value: persistent basis: Runs directly against the host project via OS primitives; no separate container/VM disk to reset. network_policy: value: proxy_mediated basis: "Domain allowlisting enforced via Fence's own HTTP/SOCKS5 proxies, block-all-by-default, and the default posture is kernel-enforced on both platforms per ARCHITECTURE.md: Linux with network-namespace support has no direct route to the network at all (raw sockets can't reach anything except the proxy bridge), and macOS's default 'proxy-only' Seatbelt profile likewise denies direct outbound connections at the sandbox-policy level, not merely by convention. Enforcement drops to cooperation-with-proxy-env-vars in documented fallback/opt-in cases: Linux environments without network-namespace support (some containers/CI), and the relaxed template (`allowedDomains: [\"*\"]`, the one documented for Cursor) on either platform -- on Linux it also disables `--unshare-net`, not just macOS's Seatbelt restriction. Its own why-fence.md calls domain-based allowlisting 'crude' regardless of enforcement path -- an allowed domain can still be used to exfiltrate data, since there's no content inspection." credential_mediation: value: ambient src: fence_configuration_docs basis: "No credential substitution/injection mechanism is documented (unlike nono/greywall's host-side proxy injection) -- any secret already in the process environment (e.g. a provider API key) stays ambient and visible to the sandboxed agent. The default 'code' template does deny filesystem reads to .env and ~/.ssh by default, and blocks cloud metadata-service IPs, but that's a filesystem/network floor, not mediation of credentials the agent legitimately needs." risk: stated_scope: value: [t1_accidents, t2_exfiltration] basis: "Its own why-fence.md frames the tool around default-deny network egress (for exfiltration/supply-chain risk) and filesystem write restrictions (for accidents), while explicitly disclaiming several other threat classes (see limitations) -- an unusually candid non-goals section for this dataset." assessed_tiers: value: [t1_accidents] ev: editorial derived_from: [classification.isolation_boundary, classification.network_policy, classification.credential_mediation] basis: "OS-sandbox boundary supports accident containment reliably, and the default network policy is kernel-enforced on both platforms (see classification.network_policy). Exfiltration-tier credit is nonetheless withheld here (unlike nono/greywall): credentials are ambient rather than mediated, so an already-ambient secret can leave through any allowed domain, which the project's own docs concede is a crude, non-content-inspecting control -- and enforcement itself falls back to cooperation-dependent in specific documented cases (no Linux network-namespace support; the relaxed template on either platform, which also disables Linux's --unshare-net). Hostile-code escape is explicitly out of scope per its own non-goals." design_intent: value: constrain basis: Framing centers on default-deny network/filesystem policy the operator configures and commits, gating agent actions. pricing: model: free_oss notes: {value: "Apache-2.0 CLI tool; no pricing page or commercial tier found (unlike Greywall, which has a company, Greyhaven, behind it with a 'coming soon' governance layer)."} footprint_notes: value: Container-free -- OS primitives (sandbox-exec/bubblewrap) applied directly to the wrapped process, no image builds or container/VM disk. basis: README frames it as a lightweight alternative to containerizing every sandboxed command. convenience_notes: - {value: "Config uses inheritance-based templates (e.g. \"extends\": \"code\") for per-agent rulesets; a monitoring mode observes actual filesystem/network needs before locking down a policy; Claude Code, Cursor, and OpenCode support hook-based rewriting of shell commands to run through fence -c automatically."} integrations: [cli, homebrew, nix, go_install, http_proxy, socks5_proxy] audience: [individual_developer, security_minded_developer] limitations: - {value: "Own docs (why-fence.md) explicitly disclaim protection against actively malicious code, resource exhaustion (no CPU/RAM/disk limits), timing attacks, and kernel escapes.", src: fence_why} - {value: "Domain-based network allowlisting is content-blind -- its own docs call this 'crude', since an allowed domain can still be used to exfiltrate data.", src: fence_why} - {value: "No credential substitution/redaction mechanism; secrets already in the process environment remain ambient to the sandboxed agent."} - {value: "Default network enforcement is kernel-enforced on both platforms (Linux network namespaces; macOS proxy-only Seatbelt profile), but degrades to cooperation-with-proxy-env-vars: on Linux without network-namespace support (some containers/CI), and under the relaxed template on either platform -- on Linux the relaxed template also disables --unshare-net, not just macOS's Seatbelt restriction.", src: fence_architecture} - {value: "7 built-in agent templates map to this dataset's taxonomy; Amp, Droid, and Crush don't have ids and aren't represented in that field.", ev: editorial, basis: "Counted directly from docs/agents.md's documented template list against this dataset's closed taxonomy.agents_supported list; the gap is this dataset's classification limitation, not something Fence's own docs state."} compliance: {value: none_stated} - id: omnigent name: Omnigent (Omnibox sandbox) default_source: omnigent_repo tagline: Databricks' open-source meta-harness for orchestrating coding-agent CLIs, with a bundled OS-sandbox feature (Omnibox) for filesystem/network isolation and credential injection. urls: {official: "https://omnigent.ai/", repo: "https://github.com/omnigent-ai/omnigent", docs: "https://omnigent.ai/docs/omnibox", blog: "https://www.databricks.com/blog/introducing-omnigent-meta-harness-combine-control-and-share-your-agents"} license: Apache-2.0 maturity: value: pre_1_0_active src: omnigent_github_api basis: "v0.5.1 as of 2026-07-10 (verified via GitHub API); 7,545 GitHub stars; repo created 2026-06-11 and pushed as recently as today (2026-07-20) -- about six weeks old but growing fast, with Databricks (incl. Matei Zaharia) publicly behind it." thread_status: value: not_from_hn_thread src: user_submitted_links_2026_07_20 basis: "User pasted the Databricks announcement blog and Omnibox docs URLs directly in-session, 2026-07-20; not part of this dataset's primary Clawk HN thread." platforms: value: [linux, macos, windows_powershell] basis: "Full filesystem+network isolation via bubblewrap+seccomp (Linux) and Seatbelt (macOS), both kernel-enforced. Windows uses a Job Object backend that is NOT equivalent: filesystem and network restrictions from the same spec fields are explicitly advisory and unenforced there (one-time warning emitted, no actual isolation). Its docstring/README also claim optional CPU/memory ceilings, but the implementation (windows_jobobject_sandbox.py's post_spawn) discards the resolved policy (`del policy`) and only ever sets JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE -- so shipped Windows behavior is process-tree kill-on-close only, weaker even than its own docs claim." agents_supported: value: [claude_code, codex, cursor, opencode, pi, goose, qwen_code, antigravity, hermes, kimi_code, copilot] src: omnigent_repo basis: "The docs page names only Claude Code, Codex, and \"custom agents\" explicitly, but the repo's own native-integration modules (claude_native*.py, codex_native*.py, cursor_native*.py, opencode_native*.py, pi_native*.py, goose_native*.py, qwen_native*.py, antigravity_native*.py, hermes_native*.py, kimi_native*.py) show real native support for ten, and harness_plugins.py registers an eleventh, SDK-based (not native-terminal) copilot harness (omnigent.inner.copilot_harness). A further kiro_native*.py integration exists with no id in this dataset's closed agents_supported taxonomy." classification: role: runtime_feature execution_locus: local isolation_boundary: value: os_sandbox basis: "Bubblewrap+seccomp (Linux) / Seatbelt (macOS) give a real kernel-enforced boundary; the platform-default backend is chosen at spec-parse time and fails loudly (raises, explicitly 'no silent fallback') if the required binary is missing, rather than silently downgrading. Windows's Job Object backend is a materially weaker boundary -- see platforms basis -- so this os_sandbox rating describes the Linux/macOS backends specifically." state_model: value: persistent basis: Runs directly against the host project via OS primitives; no separate container/VM disk to reset. network_policy: value: configurable basis: "On Linux/macOS, a default-deny egress proxy enforces an explicit allow-list of hosts/paths/methods and blocks private IPs and cloud metadata endpoints by default, backed by real kernel-level network isolation. On Windows, the identical spec fields (e.g. allow_network) are accepted but not enforced by the Job Object backend, which does no network isolation at all -- so unlike nono/greywall's more uniform proxy_mediated posture, this is genuinely per-platform rather than one consistent default." credential_mediation: value: host_side_injection src: omnigent_docs_omnibox basis: "Blog and docs describe placeholder tokens issued to the agent process, with the real credential swapped in only at the egress proxy for requests matching the allow-list, so the agent process itself never holds the real secret -- architecturally close to nono/greywall's model. That guarantee rides on the same platform split as network_policy: credible on Linux/macOS, where network really is confined to the mediated proxy path; unconfirmed on Windows, where nothing in the sandbox itself forces traffic through the proxy to begin with." risk: stated_scope: value: [t1_accidents, t2_exfiltration] basis: "Blog's own framing example is explicit: 'don't let an agent ever see your GitHub security token, but instead, inject it only in the egress proxy on approved requests' -- a direct accidents/exfiltration framing, paired with default-deny network and denied access to private IPs/cloud metadata." assessed_tiers: value: [t1_accidents, t2_exfiltration] ev: editorial derived_from: [classification.isolation_boundary, classification.network_policy, classification.credential_mediation] basis: "Credible on Linux/macOS, where the OS-sandbox boundary genuinely confines egress to the mediated proxy path and credentials never reach the agent process directly -- assessed like this dataset's other os_sandbox entries with host-side credential injection (nono, greywall). This assessment describes the Linux/macOS backends only: on Windows, filesystem and network restrictions are explicitly advisory and unenforced, so neither tier should be assumed to hold there. No hypervisor-grade boundary exists on any platform, so hostile-code escape is out of scope everywhere." design_intent: value: constrain basis: Framing centers on locking down OS/network access by default and injecting credentials only on approved egress requests -- gating rather than open-ended autonomy. pricing: model: free_oss notes: {value: "Apache-2.0, no separate Omnibox pricing. The repo's own sandbox-launcher CLI code references a Databricks-hosted remote sandbox provider ('Lakebox') as internal-only ('ships only internally'), so the externally available OSS repo's remote-hosting story is incomplete for outside users."} footprint_notes: value: OS-sandbox primitives on Linux/macOS (no container/VM); Windows relies on a Job Object that only kills the process tree together on close -- resource ceilings the docstring describes as available aren't actually wired up in the shipped code. basis: "Linux/macOS claim per the bwrap/Seatbelt backend module docstrings. The Windows correction is grounded in the implementation itself, not its docs: windows_jobobject_sandbox.py's post_spawn discards the resolved policy (`del policy`) and only ever sets JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE -- the module's own docstring and the project README both describe CPU/memory ceilings as available, which the shipped code does not implement." convenience_notes: - {value: "Bundled into a meta-harness that already integrates 11 agent CLIs/SDKs (see agents_supported) under one config, rather than requiring a separate sandbox wrapper per agent; also adds real-time session sharing/collaboration on top, per the Databricks announcement."} integrations: [cli, egress_proxy, policies, harness_plugins] audience: [individual_developer, team] limitations: - {value: "Not a standalone tool -- Omnibox has no separate package or binary; it only runs as an internal component of the full Omnigent harness.", ev: editorial, basis: "Inferred from the repo tree: sandbox logic lives in omnigent/inner/bwrap_sandbox.py, seatbelt_sandbox.py, and windows_jobobject_sandbox.py as internal modules of the omnigent package, with no separate omnibox repo, PyPI package, or binary found."} - {value: "Windows sandboxing is materially weaker than Linux/macOS: filesystem and network restrictions are explicitly advisory and unenforced on the Job Object backend, and even the CPU/memory ceilings its own docstring/README describe aren't actually implemented -- post_spawn discards the resolved policy and only ever sets kill-on-close. Shipped Windows behavior is process-tree kill-on-close, nothing more.", src: omnigent_repo} - {value: "Pre-1.0 and about six weeks old as of this audit (repo created 2026-06-11), despite fast growth (7,545 stars) and Databricks backing.", src: omnigent_github_api} - {value: "The docs page names only Claude Code, Codex, and \"custom agents\" explicitly; the fuller list recorded here (ten native-terminal integrations plus one SDK-based harness, Copilot) is inferred from the repo's own integration modules and harness registry, not itself a documented supported-agents list.", ev: editorial, basis: "Cross-checked omnigent.ai/docs/omnibox's stated agent list against the repo's *_native*.py modules and harness_plugins.py's registered harnesses -- the docs page undersells what the source actually ships."} - {value: "A Databricks-hosted remote sandbox launcher ('Lakebox') is referenced in the repo's own CLI code as internal-only, so it isn't available to external users of the OSS repo.", src: omnigent_repo} compliance: {value: none_stated} # ----------------------------------------------------------------------------- # Adjacent tools & approaches. Same claim conventions; lighter schema. # ----------------------------------------------------------------------------- adjacent: - id: paseo name: Paseo role: orchestrator default_source: paseo_docs urls: {official: "https://paseo.sh/", docs: "https://paseo.sh/docs/providers"} thread_status: {value: directly_linked, src: hn_thread} summary: value: Local-first orchestrator for multiple coding-agent CLIs; self-hostable. basis: Its own docs say it doesn't ship a coding agent — it launches and supervises existing CLIs. Not itself the trust boundary. pairs_with: [clawk, yoloai, virtdev, exe_dev] - id: skynot name: skynot role: pattern default_source: skynot_repo urls: {repo: "https://github.com/tarsgate/skynot"} thread_status: {value: directly_linked, src: hn_thread} summary: value: Dedicated-user install pattern — creates an aidev user with shared ACLs, installs Pi in that user's home, launches the agent only in a restricted work tree. basis: Documented mechanism in the repo. risk: assessed_tiers: value: [t1_accidents] ev: editorial basis: Kernel and installed programs remain shared; thread commenters disputed user separation on exactly these grounds. - id: take_ai_control name: take-ai-control role: template default_source: takeaicontrol_repo urls: {repo: "https://github.com/daitangio/take-ai-control"} thread_status: {value: directly_linked, src: hn_thread} summary: value: Template repo packaging Pi inside a devcontainer with a non-root user and explicit environment files. basis: Repo documentation. - id: scratch name: scratch role: orchestrator default_source: scratch_repo urls: {repo: "https://github.com/housecat-inc/scratch"} thread_status: {value: directly_linked, src: hn_thread} summary: value: Agent toolkit one commenter places inside sandboxes; adjacent tooling, not a boundary. ev: thread src: hn_thread - id: katsuobushi_sandbox name: katsuobushi sandbox role: template default_source: katsuobushi_repo urls: {repo: "https://github.com/cdata/katsuobushi/tree/main/lib/sandbox"} thread_status: {value: directly_linked, src: hn_thread} summary: value: Nix-flake microVM recipe for Claude Code with declarative allowlists. basis: Repo documentation. - id: nix_opencode_with_mitm name: nix-opencode-with-mitm role: template default_source: nix_mitm_repo urls: {repo: "https://github.com/riedel/nix-opencode-with-mitm"} thread_status: {value: directly_linked, src: hn_thread} summary: value: Prototype using a MITM proxy outside the sandbox for network control (allowlist/proxy); the repo's README implements only the network side — token injection was the author's stated aspiration in the source HN comment, not a shipped feature. basis: "Repo README documents mitmproxy allowlist enforcement (default models.dev) and TLS termination only. The originating HN comment (by the repo author) frames token injection as a want, not a delivered mechanism: \"What I would really want is token injection outside the sandbox and good control over the network, why I tried integrating a mitm proxy...\"" - id: separate_user_account name: Separate dedicated user account role: pattern default_source: hn_thread urls: {} thread_status: {value: mentioned_only} summary: value: A no-sudo user account proposed as "enough"; disputed on shared-kernel, blast-radius, and supply-chain grounds. ev: thread risk: assessed_tiers: value: [t1_accidents] ev: editorial basis: Shared kernel and home directory limit it to the accident tier — the thread's objections, which we endorse. - id: diy_container_plus_network name: DIY container + external network control role: pattern default_source: hn_thread urls: {podman: "https://podman.io/", pfsense: "https://www.pfsense.org/"} thread_status: {value: mentioned_only} summary: value: Podman image with a mounted /workspace, no credentials in the container, egress restricted with pfSense and VLANs. ev: thread basis: One commenter's described architecture — the container boundary treated as good enough when egress and credentials are controlled elsewhere. risk: assessed_tiers: value: [t1_accidents, t2_exfiltration] ev: editorial basis: External egress control plus credential exclusion addresses exfiltration even with a container-tier compute boundary. - id: k8s_pvc_per_agent name: Kubernetes + PVC per agent session role: pattern default_source: hn_thread urls: {kubernetes: "https://kubernetes.io/"} thread_status: {value: mentioned_only} summary: value: Pod-per-agent with persistent volumes for agent state folders. ev: thread - id: separate_machine_proxy_helper name: Separate machine + proxy + helper binary role: pattern default_source: hn_thread urls: {} thread_status: {value: mentioned_only} summary: value: Disposable VMs on another box, a credential-hiding proxy, and a host helper to spawn them. ev: thread risk: assessed_tiers: value: [t1_accidents, t2_exfiltration, t3_hostile_escape] ev: editorial basis: Physical/VM separation plus a credential-hiding proxy covers all three tiers, at high DIY cost. - id: raspberry_pi_off_laptop name: Raspberry Pi off-laptop box role: pattern default_source: hn_thread urls: {official: "https://www.raspberrypi.com/"} thread_status: {value: mentioned_only} summary: value: Physical isolation for experiments on a separate cheap machine. ev: thread risk: assessed_tiers: value: [t1_accidents, t3_hostile_escape] ev: editorial basis: A separate physical machine is a hardware-grade containment boundary; exfiltration still depends on what network and secrets you give it. - id: vm_substrates name: General VM / container substrates role: pattern default_source: hn_thread thread_status: {value: mixed} summary: value: General-purpose isolation substrates suggested as bases rather than agent products. ev: thread members: - {name: QEMU/KVM, url: "https://www.qemu.org/"} - {name: quickemu, url: "https://github.com/quickemu-project/quickemu"} - {name: Vagrant, url: "https://developer.hashicorp.com/vagrant"} - {name: Incus, url: "https://linuxcontainers.org/incus/"} - {name: UTM, url: "https://mac.getutm.app/"} - {name: mkosi, url: "https://github.com/systemd/mkosi"} - {name: podman-machine-os, url: "https://github.com/podman-container-tools/podman-machine-os"} - {name: Firejail, url: "https://github.com/netblue30/firejail"} - {name: Docker (no exposed ports), url: "https://www.docker.com/"} - {name: Apple containerization example, url: "https://github.com/apple/containerization/tree/main/examples"} - {name: devcontainers, url: "https://containers.dev/"} - {name: hardening primitives (AppArmor, bwrap, libseccomp, gVisor, Firecracker), url: null} - {name: FreeBSD jails, url: "https://docs.freebsd.org/en/books/handbook/jails/"} - id: wasm_substrates name: WASM runtimes as alternative substrate role: pattern default_source: hn_thread thread_status: {value: mentioned_only} summary: value: Cloudflare workerd/Workers and container2wasm proposed as lower-footprint substrates for agent sessions. ev: thread members: - {name: Cloudflare workerd, url: "https://github.com/cloudflare/workerd"} - {name: container2wasm, url: "https://github.com/container2wasm/container2wasm"} - id: claude_cowork_reference name: Claude Cowork (containment reference) role: pattern default_source: anthropic_containment urls: {engineering: "https://www.anthropic.com/engineering/how-we-contain-claude"} thread_status: {value: mentioned_only, src: hn_thread} summary: value: Anthropic's local-VM knowledge-work agent, used in the thread as a comparison point for vendor containment across products. basis: Anthropic containment engineering post. # ----------------------------------------------------------------------------- # Source stack — priority ordering for the site's evidence links. # ----------------------------------------------------------------------------- source_stack: - {priority: highest, kind: official_product_docs_and_readmes, why: "Where execution model, network policy, persistence, and integrations are actually documented."} - priority: very_high kind: vendor_containment_engineering_posts examples: [anthropic_containment, anthropic_sandboxing, codex_security] why: Best primary material on agent threat models and why sandboxing needs approvals plus network control. - {priority: high, kind: official_pricing_and_service_docs, why: Required for real cost comparison of managed offerings.} - {priority: high, kind: official_api_and_integration_docs, why: Integration surface is a major differentiator.} - {priority: medium, kind: repo_security_model_docs, why: "Often contain the best limitations language, especially for OSS tools."} - {priority: medium, kind: hn_thread, ref: hn_thread, why: "Discovery, adjacent approaches, and what practitioners think is missing."}