all work
● liveOpen Source Sandbox CLI tool[2026]

Safebox

Unprivileged Linux sandbox and change management engine for autonomous AI coding agents.

Problem

Autonomous AI coding agents run unconfined on developer machines with full terminal access. A single hallucinated command can execute destructive deletions like rm -rf, leak credentials from ~/.ssh, or exfiltrate private source code across unrestricted outbound network sockets.

Built

I built Safebox to isolate untrusted agents at the Linux system call boundary without requiring root privileges, background daemons, or heavy virtual machines. By composing unprivileged user namespaces, ephemeral OverlayFS scratchpads, and in-kernel Landlock Mandatory Access Control, Safebox starts in under 30 milliseconds, traps file mutations in memory, and provides instant zero-cost rollback.

100%
UNTRUSTED WORKLOADAutonomous Agent Execution$ agy -p "task"Attempts: edit, compile, shellRisks: rm -rf, token theftHost Workspace$PWD (Physical Disk)Git repos, configs, secretsREAD-ONLY BASEUnprivileged Host UserHost UID: 1000, GID: 1000Zero host root privilegesSAFEBOX SUPERVISORIn-Process Syscall Orchestration (<30ms)1. Rootless User & Mount NamespacesCLONE_NEWUSER | CLONE_NEWNS | MS_REC|MS_PRIVATE2. Ephemeral OverlayFS Scratchpadlowerdir=$PWD, upperdir=/tmpfs (userxattr)3. Landlock LSM Mandatory Access ControlPR_SET_NO_NEW_PRIVS | VFS Default-Deny4. Userspace NAT & Domain PinningCLONE_NEWNET | slirp4netns | PinnedIPSet5. In-Process PID 1 Init SupervisorRunShim | Signal Forwarding | Zombie ReapingSECURE OUTCOMESDeterministic Boundary GuaranteesVERIFIEDZero Host MutationWrites isolated in memory.Host disk remains 100% clean.< 1ms ROLLInstant Rollbacksafebox revert --yesWipes upperdir without git loss.BLOCKEDZero Exfiltration~/.ssh denied; rogue IPs dropped.

<30ms

Cold Start

0

Root Privileges

100%

LSM Enforced

0

Byte Disk Sprawl

Interactive System Exploration

namespaces > overlayfs > landlock lsm > userspace nat > pid 1 shim
interactive pipeline simulator
Stage 01/CLONE_NEWUSER

User Namespaces

Maps caller identity to container root without host privileges

Kernel Enforced
Credential Virtualization Preview

Effective UID

uid=0 (root)

Mapped via /proc/self/uid_map

Capabilities in Namespace

Full CapSet (64 caps)

Allows private mount/pivot

Host Escalation Risk

Zero Capability

Kernel blocks host VFS changes

Kernel Syscall Implementation (Go 1.24)safebox/internal/isolation
// Write single-identity credential mapping
uidMap := fmt.Sprintf("0 %d 1\n", os.Getuid())
gidMap := fmt.Sprintf("0 %d 1\n", os.Getgid())
os.WriteFile("/proc/self/uid_map", []byte(uidMap), 0644)
os.WriteFile("/proc/self/gid_map", []byte(gidMap), 0644)

0 CAP_SYS_ADMIN

Host Privileges

1 (Single ID)

UID Extent Size

Zero (/etc/subuid bypassed)

Subuid Dependency

1.2ms

Setup Latency

Safebox executes entirely in unprivileged userspace. By virtualizing process credentials through CLONE_NEWUSER and writing single-extent UID and GID mappings, the sandboxed process gains full administrative control inside its private sandbox boundary while remaining a standard unprivileged user on the host.

Safebox Simulation Engine

Select Agent Scenario:
safebox - (PID 1 shim)
net: isolatedlsm: landlock-v3starter-quota
$ # Select an agent scenario above to launch the microsecond sandbox...

Safebox establishes rootless Linux namespaces, ephemeral OverlayFS, and Landlock LSM default-deny rules before handing off to the untrusted agent CLI.

agy >

Stack

3 techs · grouped by layer

Backend

  • Go(55% learning)

Infrastructure

  • Linux(85% learning)
  • Open Source

Also used

Go 1.24Linux NamespacesLandlock LSMOverlayFSslirp4netnspastacgroups v2POSIX Signals

Links

↗ source

Related stack

techs used in Safebox
LinuxOpen SourceGo