3 ms·

I would really like to see a good local sandboxing solution in this space, something that is truly local-first. This is especially important since many coding m

I would really like to see a good local sandboxing solution in this space, something that is truly local-first. This is especially important since many coding models / agentic builders will eventually become lightweight enough to run them on-device instead of having to buy tokens and share user data with big LLM cloud providers.

dloss 1y ago
Anthropic recently released a sandboxing tool based on bubblewrap (Linux, quite lightweight) and sandbox-exec (macOS). https://github.com/anthropic-experimental/sandbox-runtime https://github.com/anthropic-experimental/sandbox-runtime I wonder if nsjails or gVisor may be useful as well. Here's a more comprehensive list of sandboxing solutions: https://github.com/restyler/awesome-sandbox https://github.com/restyler/awesome-sandbox
- gbxk 1y ago
  wow that's super new! Thanks for that, will look deeply into it and compare
gbxk 1y ago
(sorry I didn't reply in-thread, I'm new to HN, re-posting response here:) Exactly! The main local requirement is to have hardware virtualization available (e.g. /dev/kvm) but that should be fine on your local linux machine. Won't work in cloud machines or on Mac ARM in current form but maybe if I extend
- ofrzeta 1y ago
  There are some providers that offer KVM nested virtualization, I think Google Cloud, Digital Ocean ... any others?
  - gbxk 1y ago
    True! GCP does. I haven't tested it yet. I didn't know D.O does. If anyone knows others, I'm interested too!
    - eyberg 1y ago
      We (NanoVMs) can run (both unikernel and normal linux) virtualized workloads on plain old ec2 instances (eg: t2.small).
      - gbxk 1y ago
        Interesting, thanks for sharing!
elric 1y ago
Are there any such solutions that can adequately protect against side-channel attacks (à la rowhammer, meltdown, spectre, ...)? I mean protecting local file access and network access is pretty easy, but side-channels and VM escaping attacks seem like a bigger concern.
- gbxk 1y ago
  That's an interesting direction! TEE support would be relatively straightforward with current stack (and it's on my roadmap), so that could be a first step forward.
- ATechGuy 1y ago
  Side-channel attacks apply to multi-tenant cloud environments, not local.
  - elric 1y ago
    That seems like a naive take. If any of your local VMs are internet connected and are compromised, side channel attacks could be used to exfiltrate data from other VMs or the host.
    - ATechGuy 1y ago
      Then why only apply to VMs, why not apps?
mkagenius 1y ago
> something that is truly local-first Hey, we built coderunner[1] exactly for this purpose. It's completely local. We use apple containers for this (which are 1:1 mapped to a lightweight VM). 1. Coderunner - https://github.com/instavm/coderunner https://github.com/instavm/coderunner
- gbxk 1y ago
  Very cool! Apple containers run on Apple ARM so it's complimentary to my stack which doesn't support ARM yet (but soon will when extending to Qemu which supports ARM). Thanks for sharing!
_false 1y ago
What about this: https://github.com/apple/container https://github.com/apple/container
- gbxk 1y ago
  Very cool one. That's dedicated to Apple ARM which I don't currently support so the two are complimentary. Apple containers shares some primitives with Kata. I'll investigate if it's possible to use Apple containers as a VMM inside Kata, or creating an Apple Containers runtime class in Kubernetes. If either is possible, we could then potentially use Apple containers as a backend in Katakate. I need more time to study that.
sshine 1y ago
https://rstrict.cloud/ https://rstrict.cloud/ is a CLI built in Rust on top of the Landlock API for the Linux kernel. It lets you narrow the permission scope of an executable using simple command line wrappers.
- gbxk 1y ago
  Thanks, will study that one too!
kernc 1y ago
Local-first (on Lunix), POSIX shell: https://github.com/sandbox-utils/sandbox-run https://github.com/sandbox-utils/sandbox-run
- gbxk 1y ago
  Thanks for sharing, adding it to my list.

dloss 1y ago

Anthropic recently released a sandboxing tool based on bubblewrap (Linux, quite lightweight) and sandbox-exec (macOS). https://github.com/anthropic-experimental/sandbox-runtime https://github.com/anthropic-experimental/sandbox-runtime I wonder if nsjails or gVisor may be useful as well. Here's a more comprehensive list of sandboxing solutions: https://github.com/restyler/awesome-sandbox https://github.com/restyler/awesome-sandbox

gbxk 1y ago
wow that's super new! Thanks for that, will look deeply into it and compare

gbxk 1y ago

(sorry I didn't reply in-thread, I'm new to HN, re-posting response here:) Exactly! The main local requirement is to have hardware virtualization available (e.g. /dev/kvm) but that should be fine on your local linux machine. Won't work in cloud machines or on Mac ARM in current form but maybe if I extend

ofrzeta 1y ago
There are some providers that offer KVM nested virtualization, I think Google Cloud, Digital Ocean ... any others?
- gbxk 1y ago
  True! GCP does. I haven't tested it yet. I didn't know D.O does. If anyone knows others, I'm interested too!
  - eyberg 1y ago
    We (NanoVMs) can run (both unikernel and normal linux) virtualized workloads on plain old ec2 instances (eg: t2.small).
    - gbxk 1y ago
      Interesting, thanks for sharing!

elric 1y ago

Are there any such solutions that can adequately protect against side-channel attacks (à la rowhammer, meltdown, spectre, ...)? I mean protecting local file access and network access is pretty easy, but side-channels and VM escaping attacks seem like a bigger concern.

gbxk 1y ago
That's an interesting direction! TEE support would be relatively straightforward with current stack (and it's on my roadmap), so that could be a first step forward.
ATechGuy 1y ago
Side-channel attacks apply to multi-tenant cloud environments, not local.
- elric 1y ago
  That seems like a naive take. If any of your local VMs are internet connected and are compromised, side channel attacks could be used to exfiltrate data from other VMs or the host.
  - ATechGuy 1y ago
    Then why only apply to VMs, why not apps?

mkagenius 1y ago

> something that is truly local-first Hey, we built coderunner[1] exactly for this purpose. It's completely local. We use apple containers for this (which are 1:1 mapped to a lightweight VM). 1. Coderunner - https://github.com/instavm/coderunner https://github.com/instavm/coderunner

gbxk 1y ago
Very cool! Apple containers run on Apple ARM so it's complimentary to my stack which doesn't support ARM yet (but soon will when extending to Qemu which supports ARM). Thanks for sharing!

_false 1y ago

What about this: https://github.com/apple/container https://github.com/apple/container

gbxk 1y ago
Very cool one. That's dedicated to Apple ARM which I don't currently support so the two are complimentary. Apple containers shares some primitives with Kata. I'll investigate if it's possible to use Apple containers as a VMM inside Kata, or creating an Apple Containers runtime class in Kubernetes. If either is possible, we could then potentially use Apple containers as a backend in Katakate. I need more time to study that.

sshine 1y ago

https://rstrict.cloud/ https://rstrict.cloud/ is a CLI built in Rust on top of the Landlock API for the Linux kernel. It lets you narrow the permission scope of an executable using simple command line wrappers.

gbxk 1y ago
Thanks, will study that one too!

kernc 1y ago

Local-first (on Lunix), POSIX shell: https://github.com/sandbox-utils/sandbox-run https://github.com/sandbox-utils/sandbox-run

gbxk 1y ago
Thanks for sharing, adding it to my list.