Sandbox

Giving an agent a shell is useful right up until the boundary becomes unclear. I wanted an isolation primitive that felt like a TypeScript library, with policy held by the host instead of scattered through guest code.

Sandbox boots Linux microVMs through libkrun. The host controls filesystems, network access, machine state, and credential injection while code runs inside the VM.

Let the guest use a token it never owns

The VM can make an ordinary request to GitHub. The host decides whether to allow the connection and adds a short-lived installation token on the way through.

network: network.policy(async (connection) => {
  const github = connection.matchHttp('api.github.com');
  if (!github || !(await tokens.canServe(github))) return;

  github.accept(async (request) => {
    request.headers.set(
      'authorization',
      `Bearer ${await tokens.tokenForRequest(request)}`,
    );
  });
}),

Inside the guest, curl https://api.github.com/user is just Linux doing Linux things. The credential source and egress decision stay outside the machine.

Keep the machine, not another whole image

An agent can come back to installed packages, cloned repositories, and warmed caches on its next boot:

rootfs: rootfs.cow({
  base: alpineAgentImage,
  writable: new AgentMachineStore({
    bucket: 'agent-machines',
    keyPrefix: 'lanes/github-worker',
  }),
}),

Only the machine’s changes go to the writable store. The application chooses where those blocks live, while many agents can share one pinned base image.