Community members outline advanced sandboxing approaches and questions
5 Sep 22 1:38 PM · 1d ago · 2 comments · 1 source · development 5 of 5
Multiple commenters propose or request clarity on additional features (automatic HTTP proxy, profile composition) and note the absence of information about enterprise solutions used by major AI labs.
“What does Anthropic, OpenAI, SpaceXAI, Google and Amazon do in house to deal with the isolated agent environment problem?”
programdmixedbit (Jan) Drop creatorp2004a Drop early userrefibrillator Developer working on parallel solution
The whole story articlespostscomments the bright band is this development · numbered dots are the others · click one to jump
What people said 4 voices · verbatim
-
As everyone mention, there are a lot of implementations of this idea, and not only for agent workflows.My own approach has the following features, hopefully that gets stolen into an actual softawre package at some point:- Generate bwrap options (for use in bwrap or gVisor) rather than build the sandbox itself. I wont't trust a random sandbox.- UDS…
-
So there are a lot of ad-hoc solutions everybody is using for agent isolation and Drop looks well thought out. But the obvious question is what do the pros use? What does Anthropic, OpenAI, SpaceXAI, Google and Amazon do in house to deal with the isolated agent environment problem?Based on past experience I'm guessing everybody is using…
-
This is a really interesting middle ground between venvs and containers. How much overhead does gVisor add in practice for typical local development workloads?
-
I don't see a difference to containers, which also use namespaces and make it easy to mount home as read only?
All 5 developments of Drop: rootless Linux sandbox for safer third-party code… →
Hacker NewsNewswires