Run Agents under gVisor

How-to. Put agents (and run_checks) behind gVisor's user-space kernel. A container escape then needs a gVisor escape and a host kernel exploit. Model servers are unaffected; only sandboxes change.

gVisor is optional but recommended. Without it, sandboxes use Docker's default runtime (runc) and share the host kernel, and the launcher logs a recommendation at startup.

1. Install runsc (needs root)

Ubuntu/Debian, amd64 or arm64 (from gvisor.dev):

sudo apt-get update && sudo apt-get install -y apt-transport-https ca-certificates curl gnupg
curl -fsSL https://gvisor.dev/archive.key | sudo gpg --dearmor -o /usr/share/keyrings/gvisor-archive-keyring.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/gvisor-archive-keyring.gpg] https://storage.googleapis.com/gvisor/releases release main" | sudo tee /etc/apt/sources.list.d/gvisor.list > /dev/null
sudo apt-get update && sudo apt-get install -y runsc

2. Register it with Docker, allowing host-socket connects

The agent's only channel is a bind-mounted unix socket. By default, gVisor refuses connections to host unix sockets (--host-uds=none). open allows connecting to an existing socket, and nothing more:

sudo cp /etc/docker/daemon.json /etc/docker/daemon.json.bak 2>/dev/null || true
sudo runsc install -- --host-uds=open
sudo systemctl reload docker        # reload, not restart: running containers keep running
docker run --rm --runtime=runsc --network none alpine dmesg | head -2   # prints gVisor's boot messages

3. Switch agentbox to it

On a fresh install, scripts/setup.sh detects runsc with --host-uds=open and writes AGENTBOX_AGENT_RUNTIME=runsc into the new .env for you. On an existing install:

echo 'AGENTBOX_AGENT_RUNTIME=runsc' >> .env
docker compose up -d agentbox-launcher
scripts/smoke-test.sh

With AGENTBOX_AGENT_RUNTIME set, the smoke test also checks that the sandbox really ran under that runtime. list_models reports the active runtime as live.sandbox_runtime.

The launcher checks the runtime at startup and refuses to start if:

• AGENTBOX_AGENT_RUNTIME names a runtime Docker doesn't have, or
• runsc is registered without --host-uds=open, in which case agents couldn't reach their model socket.

The error message says how to fix it.

Agent containers and run_checks containers use the configured runtime. The few-second ownership-handoff container always uses runc: it runs a fixed chown -R -h and no untrusted code, and gVisor's own threads wouldn't fit its 16-pid limit.

Networking under gVisor: sandboxes use NetworkMode: none, which gives a private namespace with only lo. agentbox deliberately doesn't set Docker's NetworkDisabled: under gVisor that removes lo as well, which would break the agent's 127.0.0.1 relay and any test that starts a local server. Verified for both runtimes: only lo, localhost servers work, the internet and the host's model servers are unreachable, uid 64000. Expect slower syscall-heavy work (large test suites, heavy file I/O). Model inference is unaffected, because it runs outside the sandbox.

To revert, remove the line from .env, then run docker compose up -d agentbox-launcher.