afshinmeh

5 ms·

31.
by afshinmeh 7mo ago
I will run the same benchmark test on wasm sandboxes just to be able to compare it with Zerobox. I will share the results tomorrow.
32.
by afshinmeh 7mo ago
I added some basic --debug support earlier today, but I will work on proper JSONL/Otel integration soon.
33.
by afshinmeh 7mo ago
I think there is still a valid case for sandbox logs/otel. strace would give you the syscalls/traces but not _why_ a particular call was blocked in side the sandbox (e.g. the decision making bit).
34.
by afshinmeh 7mo ago
That's true and the expected behaviour but I see your point. The example there is not great, I should've used `sk_s123...` to show that you are passing the env var to the sandbox as opposed to setting it on the host, then proxying
35.
by afshinmeh 7mo ago
Here is the video, running Claude with Zerobox, you can see the latency, etc. https://www.youtube.com/watch?v=xzsGsSsx0OI
36.
by afshinmeh 7mo ago
I know. I will add more docs soon though, that should make it easier to navigate the code and understand what's going on.
37.
by afshinmeh 7mo ago
That was my thinking, too. The only other option would be reimplement it in Rust (never researched what exists though).
38.
by afshinmeh 7mo ago
I'd love to hear your thoughts! I've been primarily testing this with Bun + Vercel AI SDK for tool call sandboxing.
39.
by afshinmeh 7mo ago
It does but because I'm inheriting the seatbelt settings from Codex, I'm not resetting it in Zerobox (I thought it's a safer option). Let me look into this, there should be a way to take Codex' profile and safely combine
40.
by afshinmeh 7mo ago
No, it's stateless right now. What is your requirement though? How do you define a session? Are you referring to "snapshotting" between sessions?
41.
by afshinmeh 7mo ago
On macOS, the proxy is best effort. Programs that ignore HTTPS_PROXY/HTTP_PROXY can connect directly. This is a platform limitation (macOS Seatbelt doesn't support forced proxy routing). BUT, the default behaviour (no net) is full
42.
by afshinmeh 7mo ago
Ohh! thanks for sharing this. You are using DNS proxy which is interesting and useful if a process doesn't respect the HTTPS_PROXY/HTTP_PROXY/etc. env vars that I'm injecting. I will take a look, very interesting.
43.
by afshinmeh 7mo ago
I'd love to learn more please. I'm interested in sandboxing AI tools/agents regardless of the underlying mechanism (I explored Firecracker VMs briefly as well, terrible cross platform support though).
44.
by afshinmeh 7mo ago
Zerobox uses the same kernel mechanisms (namespaces + seccomp) but no daemon, no root and cold start ~10ms (Docker is much worse in that regard). Docker gives you full filesystem isolation and resource limits. Zerobox gives you granular fil
45.
by afshinmeh 7mo ago
Great question! On Linux, yes, network namespaces enforce that and all net traffic goes through the proxy. Direct connections are blocked at the kernel level even if the program ignores proxy env vars, but I will test this case a bit more (
46.
by afshinmeh 7mo ago
Thanks for sharing this, I read your comment multiple times. What would be the alternative though? It is true that the program being written in Rust doesn't solve the problem of spawning subprocesses, but what's the alternative in
47.
by afshinmeh 7mo ago
Give me 2 days :)
48.
by afshinmeh 7mo ago
Oh I see. It inject HTTP_PROXY/HTTPS_PROXY/etc. env vars into the process so that all sandboxed subprocesses go through the proxy.
49.
by afshinmeh 7mo ago
Zerobox creates a cert in `~/.zerobox/cert` on the first proxy run and reuses that. The MTIM process uses that cert to make the calls, inject certs, etc. This is actually done by the underlying Codex crate.
50.
by afshinmeh 7mo ago
I'd like to know what level of details you'd expect. Something like `zerobox -- claude`, then you get an output log like this: ``` Read file /etc/passwd Made network call to httpbin.org Write file /tmp/access `
51.
by afshinmeh 7mo ago
Not sure. I took this idea from the Deno sandboxing docs. They also do the exact same thing, different sandboxing mechanism though (I think Deno has it's own way of sandboxing subprocesses).
52.
by afshinmeh 7mo ago
Fantastic! I like that idea. I'm also exploring an option to define profiles, but also have predefines profiles that ships with the binary (e.g. Claude, then block all `.env` reads, etc.)
53.
by afshinmeh 7mo ago
Thanks for sharing that. Zerobox _does_ use the native OS sandboxing mechanisms (e.g. seatbelt) under the hood. I'm not trying to reinvent the wheel when it comes to sandboxing. Re the URLs, I agree, that's why I added wildcard su
54.
by afshinmeh 7mo ago
I agree and you can deny all reads like this: ``` zerobox --deny-read=/ -- cat /etc/passwd ``` That being said, what the default DX shouldl be? What paths to deny by default? That's something I've been thinking abou
55.
by afshinmeh 7mo ago
Thanks and agreed! Zerobox uses the Deno sandboxing policy and also the same pattern for cred injection (placeholders as env vars, replaced at network call time). Real secrets are never readable by any processes inside the sandbox: ``` zero
56.
by afshinmeh 7mo ago
That's correct. The pattern is: reads allowed, write and network I/O blocked by default. ``` zerobox -- curl https://example.com Could not resolve host: example.com ```
57.
by afshinmeh 7mo ago
That's right. It uses the same kernel mechanisms as Docker, the runtime is different though (bwrap on linux, seatbelt on mac, etc.)
58.
by afshinmeh 7mo ago
That's interesting, thanks for sharing that. Could you elaborate a bit more? I'd like to understand the use case is a bit better.
59.
by afshinmeh 7mo ago
Simon! Thanks. I appreciate your comment and totally agreed. I will improve the docs as well as tests.
60.
by afshinmeh 7mo ago
I agree to some extend. I'm using the OpenAI Codex crates for sandboxing though, which I think it's properly tested? They launched last year and iterated many times. I will add a note though, thanks!

More ›