← Back
Home › Systems › AI and agent security

agent-sandbox

sandboxed code execution for agents

E2B, Firecracker sandboxes

SystemTechniques · 14Primitives · 57 agent-sandbox Deterministic simulation testingdistributed · medium: Run the whole system in one thread under a seeded scheduler with simulated network, disk and clock, so every failure replays from its seed.›Primary-backup replicationdistributed · medium: One node orders all writes and ships them to standbys; the acknowledgement rule (none, one, all) sets what a crash loses, and an external arbiter decides who takes over.›Coverage-guided fuzzingsecurity · medium: Mutate inputs, run an instrumented target, and keep any input that reaches a new code edge; feedback turns blind guessing into incremental search.›Egress proxy filteringsecurity · medium: Forcing sandbox network traffic through a proxy with domain allowlists, TLS SNI checks and request loggingMicrovm isolationsecurity · medium: Minimal KVM-based VMs (Firecracker-style) with tiny device model, fast boot and snapshot restoreProcess sandboxingsecurity · medium: Run risky work in a separate, deliberately powerless process and let a small privileged broker do the few things it needs, over a narrow pipe.›Point-in-time recoverystorage · medium: Periodic base backups plus a continuously archived change log let you rebuild the state as of any instant, then branch from there.›Leasesdistributed · low: A lock that expires on its own: bounded-time ownership that survives crashes and partitions, given bounded clock drift and fencing tokens on writes.›Cgroups and namespaceshardware-os · low: Linux namespaces limit what a process can see; cgroup v2 limits and accounts what it may use. Containers, sandboxes and job schedulers are built from the two.›Hardware virtualization kvmhardware-os · low: VT-x/AMD-V via KVM: vCPU run loop, VM exits, MMIO emulationVirtio deviceshardware-os · low: Virtqueue rings for paravirtual block, net and vsock devicesSeccomp bpfsecurity · low: Syscall filtering with seccomp BPF programsOverlay filesystemhardware-os · low: Union mounts (overlayfs) stacking read-only layers under a writable layerLeast privilege and isolationsecurity · low: Assume every component will be compromised and limit what it can then reach: narrow identities, separate accounts, sandboxed processes.›Copy on write snapshotsstorage · low: Point-in-time snapshots by sharing pages/extents and copying only on writeAgent sandboxingagentic-ai · unknown: Hdr histogramdata-structures · low: Log-linear bucketed histograms with bounded relative error for latency percentilesProcess supervisionhardware-os · low: A parent process starts services, reaps their exits and restarts them under a delay and burst-limit policy, then stops them with SIGTERM before SIGKILL.›Pseudo terminalshardware-os · low: Pseudo-terminals, job control and terminal escape handlingWebSocketsnetworking · low: Full-duplex message framing over one upgraded HTTP connection; the standard way to push real-time data to browsers.›Bin packingoptimization · low: Pack items of given sizes into the fewest fixed-capacity bins; sort descending, then first-fit, gives at most 11/9 of optimal and runs in O(n log n).›Mutual TLSsecurity · low: TLS where the client also proves a certificate key, so every connection carries a verified, rotatable machine identity.›Secrets managementsecurity · low: Keep keys and passwords out of code and logs, give workloads short-lived identity instead of static keys, and make rotation routine.›+ 7 more techniques+ 41 more primitives

Similar systems

Share the most building blocks with this one.

cloud-dev-env 43 %online-judge 42 %serverless 40 %browser-test-grid 39 %agent-browser-isolation 38 %