Skip to content

Agent sandboxing docs#9612

Draft
ntrogh wants to merge 2 commits intomainfrom
ntrogh/sandboxing
Draft

Agent sandboxing docs#9612
ntrogh wants to merge 2 commits intomainfrom
ntrogh/sandboxing

Conversation

@ntrogh
Copy link
Copy Markdown
Contributor

@ntrogh ntrogh commented Mar 27, 2026

Fixes #9588

@ntrogh ntrogh requested review from Copilot and isidorn and removed request for Copilot March 27, 2026 19:58
@ntrogh ntrogh changed the title First draft of agent sandboxing Agent sandboxing docs Mar 27, 2026
@isidorn
Copy link
Copy Markdown
Contributor

isidorn commented Mar 30, 2026

@ntrogh thank you for pushing on this one. Is this PR ready for my review/feedback?

@ntrogh
Copy link
Copy Markdown
Contributor Author

ntrogh commented Mar 30, 2026

@isidorn yes, feel free to review. Thanks


> [!NOTE]
> Terminal sandboxing is currently in preview and is only supported on macOS and Linux. On Windows, the sandbox settings have no effect.
> Terminal sandboxing is currently in preview and is only supported on macOS and Linux. On Windows, only WSL2 environments are supported.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This puts Windows as not officially supported. But WSL might be the actual path forward. I would frame it slightly differently for windows to say that it uses WSL

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What about this?

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would not say only WSL2 environemnts are supported, but that we use WSL2 as an underlying implementation. At the end of the day users might not care

* Network access is blocked for all domains by default
* Commands run without the standard confirmation dialog
* Commands have read access to the entire file system
* Commands have write access only to the current working directory and its subdirectories
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dileepyavan is this correct? What about the TMP directory - how are we treating it now?

@isidorn
Copy link
Copy Markdown
Contributor

isidorn commented Mar 30, 2026

Great start. I left comments. @dileepyavan would be great if you can also give this a review some time this week

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Agent sandbox docs

2 participants