Sandbox execution options: minimal Python-slim path vs dedicated image

[christian-taillon]

Awesome project - very cool work, and I'm genuinely glad to see one with security considerations baked in from the start.

Related to that, I'm excited to help close the gap on reliable sandboxing/isolation in a containerized workflow. In cyber, a usable secure-by-default workflow is critical for adoption, especially with increasing threats targeting autonomous coding systems.

TL;DR

• What: sandbox execution had reliability issues across container runtime/host combinations.
• Why: base image/tooling mismatches, container-host permission contexts, and runtime env details caused failures.
• How: I validated two approaches:
  1. Minimal-change path: keep python:3.11-slim and install only what sandbox execution needs.
  2. Alternative path: dedicated Node-first sandbox image with tighter toolchain control.

I am proposing a PR with the minimal-change Python-slim approach first, and documenting the dedicated-image approach as a future option if you want stronger packaging/control boundaries.

[christian-taillon]

I'm opening a PR that attempts to fix isolation with as minimal changes as possible using python:3.11-slim.

However, for maintainers' reference: before pivoting to the minimal Python-slim path, I validated an alternative approach from commit 612356e using a dedicated Node-based sandbox image.

Previous image approach

• Image tag: nightwire-sandbox:latest
• Base image: node:20-slim

Why it worked

• Claude CLI installed globally via npm in the image.
• Non-interactive Claude config in the image (CI=1 + preseeded config).
• SELinux-compatible mount labeling (:z) and user namespace handling (--userns=keep-id).
• Host env passthrough kept minimal (only ANTHROPIC_API_KEY) to avoid PATH/HOME leakage.

Difference vs the minimal PR path

• Current PR: keeps maintainer intent centered on python:3.11-slim with only required additions.
• Alternative (this comment): dedicated Node-first runtime with tighter toolchain packaging.

If you'd like later, this Node-first path could be promoted to an officially versioned/published sandbox image for stronger runtime control.

[HackingDave]

Thanks for this post, I took the bits needed to incorporate this and will get these features added. Good stuff!