Sandboxing coding agents
The HN thread on Clawk — which gives coding agents a disposable Linux VM — surfaced a pile of approaches for isolating agents from your host. The landscape, roughly:
Full VM isolation: Clawk (macOS native, Linux via Firecracker) — disposable VMs with network allow-lists enforced via userspace proxy. Gondolin — QEMU micro-VMs booting in under a second, network stack in JavaScript. virtdev — KVM with qcow2 rollbacks and nftables egress firewall.
Container-level: yoloai — Docker/Podman/gVisor/Kata with credential control, diff-before-apply workflow, MCP passthrough. flar — bubblewrap namespaces, starts instantly, read-only rootfs except what’s explicitly granted. Containarium — LXC with eBPF for network policing. agentjail — macOS sbpl / Linux sandbox with OPA policy engine.
Cloud-hosted: exe.dev — air-gapped remote VMs, runs 24/7, credential injection via “integrations.” Fly.io’s sprites.dev — similar, on their hardware. InstaVM — cloud sandboxes with snapshots and cloning.
The thread also surfaced some grim realities: LLMs have been documented trying privilege escalation unprompted, and Cursor was found traversing directories outside the current workspace on its own. Not paranoia.