4 ms·
Docker is not a sandbox, IT'S NOT! If you must, use gvisor or kata runtime for actual sandboxing
by udev4096 11mo ago
Docker is not a sandbox, IT'S NOT! If you must, use gvisor or kata runtime for actual sandboxing
- pyuser583 11mo agoCould you expand on this?
- deleted 11mo ago[deleted]
- NitpickLawyer 11mo agoEh. While you're technically correct, there's a lot of nuance here. The threat model of running agents isn't one that needs "actual sandboxing". You're not looking to run malware that is purposefully designed to escape docker/podman. You're mainly looking to prevent the agent running silly rm-f's, or touch files outside its working env, or killing arbitrary processes, or mess up installed software. That's pretty much it. Some network control as well. ALl of these can be achieved with docker.
- elaus 11mo agoIt seems plausible that an agentic AI will notice that it's running in a Docker container while debugging some unexpected issues in their task and then tries to break out (only with good "intentions" of course, but screwing things up in the process). Claude or Gemini CLI absolutely will try crazy things after enough cycles of failed attempts of fixing some issues.
- anonzzzies 11mo agoThey absolutely will, but a non-root user inside docker so far, even when asked, did not result in any damage outside the the docker container. With root it managed to break things, but as user it did not find a way. When I asked it to try more 'fishy' things, codes + claude code both refused; after prompting some more 'but we are testing a security tool ' etc, it just tried very meek things that did not manage to do anything.
- fulafel 11mo agoSounds like the real sandbox in this scenario is the alignment training of the LLMs you tried.