ai-sandboxes.yaml

# =============================================================================
# AI Agent Sandboxes — structured dataset (evidence-carrying edition)
#
# Derived from: "AI Sandboxes and Adjacent Approaches from the Clawk Hacker
# News Thread" (HN item 48892859) plus the official docs cited therein.
#
# v0.2.0 change: no bare ratings. Every non-identity field is a CLAIM that
# carries its evidence. Fields with no evidentiary basis were deleted
# (the v0.1 setup_burden / approval_friction / state_ergonomics scales).
#
# v0.2.1 change: primary-source audit pass (2026-07-14). Fixed stale version
# bases, wrong credential/network classifications, overclaimed agent lists,
# and promoted aide from adjacent-orchestrator to a principal sandbox entry.
#
# v0.2.2 change: added nono.sh and strongdm/leash (2026-07-20), both sourced
# from a user-submitted recommendation (private email) rather than the HN
# thread — see their thread_status fields.
#
# v0.2.3 change: full primary-source re-audit (2026-07-20), fanned out across
# parallel research agents plus an independent codex CLI cross-check (grok
# unavailable — not authenticated in this box). Fixes: added agents shipped
# since the last audit (clawk: opencode; flar, yolobox: kimi_code; agentjail
# version bump to v0.9.0 + Monitor Mode); fixed a dead instavm_coderunner blog
# link; upgraded exe_dev.credential_mediation from unspecified to
# managed_integration (Integrations docs); noted the sprites.dev -> fly.io/
# sprites redirect; corrected claude_code_sandbox's maturity (no longer beta —
# that label now belongs to a separate @anthropic-ai/sandbox-runtime package),
# added missing windows_wsl2 platform, replaced an unsupported os_keyring
# credential_mediation claim with the actual ambient/deny/mask mechanism, and
# corrected an overclaimed compliance field (ISO/IEC 42001 is aspirational
# only, no active certifications); replaced codex_sandbox's same unsupported
# os_keyring claim with unspecified; resolved nono's network-default hedge and
# noted its --env-credential fallback mode; corrected nix_opencode_with_mitm's
# overclaimed token-injection feature (aspirational in the source, not
# shipped); re-sourced wasm_substrates' container2wasm link to its own repo.
# Also fixed a pre-existing, dataset-wide YAML correctness bug: 23 inline
# flow-mapping values contained an unquoted comma, which any standards-
# compliant YAML parser (confirmed via Python's PyYAML, not just this repo's
# lenient yq) silently splits into a truncated string plus a bogus null-valued
# key — corrupting data for any real consumer, not just a display quirk.
# Quoted every affected value; verified zero remain via an automated scan.
#
# v0.2.4 change: grok CLI came back online after v0.2.3 shipped, so it ran
# the same 5-question second opinion pass codex had already done for
# claude_code_sandbox/codex_sandbox. All 5 answers matched codex and this
# dataset's edits. One refinement from grok's answer: reworded
# claude_code_sandbox.compliance so it's scoped to what the two cited
# engineering posts say, not read as "Anthropic holds no certifications
# anywhere" — Anthropic's separate Trust Center does document an actual
# SOC 2 Type II report and ISO 27001 certificate at the company level; the
# two sandboxing/containment posts just don't discuss it.
#
# v0.2.5 change: closed the agents_supported and platforms taxonomies. Both
# were free text — 31 distinct agent ids and 16 platform ids across the
# sandboxes, full of near-duplicates (claude/claude_code/claude_code_cited;
# gemini/gemini_cli; macos/macos_cloud/macos_apple_silicon; wsl/windows_wsl2)
# that made the site's facet filters noisy rather than useful. Added closed
# `taxonomy.agents_supported` (21 ids) and `taxonomy.platforms` (11 ids) lists
# and migrated every sandbox entry onto them. Nowhere was data silently
# dropped: any nuance an old id used to carry alone (virtdev's
# claude_code_cited meaning "mentioned in passing, not a real integration";
# instavm_coderunner's macos_apple_silicon meaning "Apple Silicon only, not
# Intel") now lives explicitly in that field's basis text instead.
#
# v0.2.6 change: added three sandboxes entries (2026-07-20). Greywall
# (GreyhavenHQ) -- container-free deny-by-default OS sandbox (bubblewrap/
# Landlock/seccomp/eBPF + kernel-level TUN network capture on Linux, Seatbelt
# on macOS) with host-side credential substitution; user-submitted
# recommendation. Fence (fencesandbox, formerly Use-Tusk) -- the lighter-weight
# sandbox Greywall's authors evaluated and moved away from, added while
# investigating that history; default network policy turned out to be
# kernel-enforced on both platforms (not cooperation-dependent, as first
# assumed), but credentials stay ambient -- no substitution mechanism.
# Omnigent/Omnibox (Databricks) -- OS-sandbox feature bundled inside an
# open-source multi-agent meta-harness (classified runtime_feature, not a
# standalone tool); its Windows backend turned out to provide only
# process-tree kill-on-close, not the CPU/memory ceilings its own docs
# describe. All three: ships profiles/integrations for several agents with no
# id in the closed agents_supported taxonomy (Amp, Cline, Kilo, Auggie, Droid,
# Crush, Kiro) -- recorded in each entry's basis text rather than growing that
# taxonomy per-agent, a deliberate call not to chase every individual agent
# id. A fourth candidate (XaresAICoder, a self-hosted browser IDE bundling
# several agent CLIs) was investigated and deliberately left out: real,
# actively maintained project, but a generic dev-environment container (like
# github_codespaces) rather than a boundary purpose-built around an agent's
# threat model -- no default egress policy, no credential mediation, and
# seccomp explicitly disabled for debugger compatibility.
#
# v0.2.7 change: finished the v0.2.3 unquoted-comma fix. 19 more inline
# flow-mapping values (in flar, virtdev, exe_dev, agentcage, bitrise_rde,
# github_codespaces, byre, nono, vm_substrates, and three taxonomy labels) were
# still being split by YAML parsers into a truncated string plus a bogus
# null-valued key. Quoted them; a full-file scan now finds no unexpected nulls.
#
# v0.2.8 change: added discobox (2026-10-01), sourced from an inclusion
# request rather than the HN thread — see its thread_status field.
#
# v0.2.9 change: added docker_sandboxes (Docker Sandboxes / sbx), contributed
# by an outside contributor (PR #2, 2026-08-28) and corrected against
# docs.docker.com on 2026-10-01: maturity, cloud mode (hybrid locus), network
# presets, pricing note, Devin in the agent list, license, and the shared
# skills default.
# =============================================================================

meta:
  title: AI Agent Sandboxes & Adjacent Approaches
  version: "0.2.9"
  generated: "2026-07-14"
  updated: "2026-10-01"
  primary_thread:
    title: "Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop"
    url: "https://news.ycombinator.com/item?id=48892859"

  evidence_levels:
    official: Stated in the product's own docs, README, or vendor engineering posts.
    thread: Asserted by commenters in the HN thread; not vendor-confirmed.
    editorial: Inference by the dataset authors; must show its basis.

  conventions: >-
    Any classification/risk/cost/convenience field is either a plain
    scalar/list (SHORTHAND) or a CLAIM OBJECT. Shorthand means evidence level
    "official", sourced from the entry's default_source. Claim objects have
    keys {value, ev, src, basis, derived_from}; ev defaults to official and
    src defaults to default_source when omitted. Every ev: editorial claim
    MUST carry a basis and, where applicable, derived_from listing the
    documented fields it was inferred from. A renderer's "official claims
    only" toggle hides any claim whose effective ev is not official.
    The literal string "unspecified" means primary sources were silent —
    render it as a visible badge, never a blank cell.

# -----------------------------------------------------------------------------
# Taxonomy — closed vocabularies for filterable facets.
# (v0.1's editorial cost/convenience ordinal scales are gone; only facets that
# can be grounded in documentation remain.)
# -----------------------------------------------------------------------------
taxonomy:
  product_role:
    - {id: runtime, label: Sandbox runtime, description: Directly creates and owns the execution boundary.}
    - {id: runtime_feature, label: Built-in sandbox feature, description: Sandboxing shipped inside a larger agent product.}
    - {id: policy_wrapper, label: Policy wrapper, description: Intercepts or supervises another runtime's tool calls.}
    - {id: remote_workspace, label: Remote workspace, description: Hosted dev environment usable as an agent sandbox.}
    - {id: orchestrator, label: Orchestrator, description: Launches or supervises agents; not itself the trust boundary.}
    - {id: template, label: Template / recipe, description: Reusable setup pattern built on other substrates.}
    - {id: pattern, label: DIY pattern, description: "An approach, not a product."}

  execution_locus:
    - {id: local, label: Local (user's machine)}
    - {id: self_hosted_remote, label: Self-hosted remote}
    - {id: vendor_cloud, label: Vendor-managed cloud}
    - {id: hybrid, label: Hybrid local + cloud}

  isolation_boundary:
    # Ordered weakest -> strongest always-on boundary. `strength` lets the UI
    # derive footprint/credibility framing from the documented boundary itself
    # instead of storing per-entry editorial ratings.
    - {id: user, label: Separate OS user, strength: 1}
    - {id: os_sandbox, label: OS sandbox (Seatbelt / Bubblewrap / seccomp), strength: 2}
    - {id: container, label: Container / namespace, strength: 3}
    - {id: microvm, label: MicroVM (Firecracker / QEMU microVM / Apple container), strength: 4}
    - {id: vm, label: Full VM (KVM / QEMU / hypervisor), strength: 5}
    - {id: layered, label: Layered (multiple essential boundaries), strength: null}

  state_model:
    - {id: ephemeral, label: Ephemeral — resets by design}
    - {id: resumable, label: Resumable — sessions/snapshots survive}
    - {id: persistent, label: Persistent — disks/volumes survive indefinitely}
    - {id: copy_apply, label: Copy/diff/apply — changes staged in a clone}
    - {id: configurable, label: Configurable per mode}

  network_policy:
    - {id: open, label: Open outbound by default}
    - {id: allowlist, label: Outbound allowlist}
    - {id: proxy_mediated, label: Inspecting / mediating proxy}
    - {id: none, label: No network}
    - {id: operator_managed, label: Operator/vendor-managed policy}
    - {id: configurable, label: Configurable (open/allowlist/none modes)}

  credential_mediation:
    - {id: ambient, label: Ambient — host env visible to agent}
    - {id: mounted, label: Mounted — secret present inside runtime as file/env}
    - {id: forwarded, label: "Forwarded — e.g. SSH agent socket, key stays off-guest"}
    - {id: host_side_injection, label: Host-side injection — secret added only on egress}
    - {id: os_keyring, label: OS keyring — agent auth in system keychain}
    - {id: managed_integration, label: Managed integration — vendor service connector}
    - {id: unspecified, label: Unspecified in primary sources}

  threat_tier:
    - id: t1_accidents
      label: Accidents
      description: Agent runs a destructive command in the wrong place.
    - id: t2_exfiltration
      label: Prompt-injection exfiltration
      description: Agent tricked into shipping secrets or data out; needs egress control and/or credential mediation.
    - id: t3_hostile_escape
      label: Hostile code escape
      description: Malicious code attempts to break the boundary; hypervisor-class isolation is the broadly credible answer.

  design_intent:
    - {id: constrain, label: Constrain the agent, description: "Check, gate, or block agent actions."}
    - {id: liberate, label: Liberate the agent, description: Build a wall so the agent can run unsupervised inside it.}
    - {id: both, label: Both / configurable}

  pricing_model:
    # Factual, documentable. Replaces v0.1's editorial cost block.
    - {id: free_oss, label: Free / open source}
    - {id: free_tier_plus_usage, label: Free tier + pay-as-you-go}
    - {id: paid_usage, label: Usage-based paid}
    - {id: paid_subscription, label: Subscription (may add usage)}
    - {id: contact_sales, label: Contact sales / pricing in flux}
    - {id: product_feature, label: Bundled feature of a paid product}
    - {id: unspecified, label: Unspecified in primary sources}

  # Closed v0.2.5 -- previously free text (31 distinct ids for agents, 16 for
  # platforms, full of near-duplicates like claude/claude_code/claude_code_cited
  # or macos/macos_cloud/macos_apple_silicon). Every entry's agents_supported
  # and platforms values now resolve to one of these ids; any nuance an old id
  # used to carry alone (e.g. "cited as an example, not a first-class
  # integration") now lives in that field's basis text instead.
  agents_supported:
    - {id: claude_code, label: Claude Code}
    - {id: codex, label: Codex CLI}
    - {id: gemini_cli, label: Gemini CLI}
    - {id: copilot, label: GitHub Copilot}
    - {id: cursor, label: Cursor}
    - {id: aider, label: Aider}
    - {id: opencode, label: OpenCode}
    - {id: pi, label: Pi}
    - {id: qwen_code, label: Qwen Code}
    - {id: grok, label: Grok}
    - {id: goose, label: Goose}
    - {id: antigravity, label: Antigravity}
    - {id: openclaw, label: OpenClaw}
    - {id: hermes, label: Hermes}
    - {id: reasonix, label: Reasonix}
    - {id: kimi_code, label: Kimi Code}
    - {id: shelley, label: Shelley (web agent)}
    - {id: moltbot, label: Moltbot (Clawdbot)}
    - {id: mcp_orchestrated, label: MCP-orchestrated agents (generic), description: Named as supporting agents driven via MCP rather than a specific product.}
    - {id: generic_command_execution, label: Generic command execution, description: Runs arbitrary shell commands; not tied to any named agent.}
    - {id: agent_agnostic, label: Any agent (agent-agnostic), description: "Stated to work with whatever agent you point at it, without naming specific ones."}

  # Platforms conflates host OS with access method by design of the source
  # data (e.g. exe.dev and Fly Sprites are fully remote, so "platform" means
  # how you reach them, not an OS) -- rather than force a schema split, this
  # stays one closed list, disambiguated by label. Hosting/locus (local vs.
  # vendor-cloud) is already classification.execution_locus's job, so the old
  # macos_cloud/linux_cloud/arch_linux_host/macos_apple_silicon ids collapse
  # to their base OS here, with any real constraint (Arch specifically,
  # Apple Silicon specifically) kept in that entry's platforms basis.
  platforms:
    - {id: macos, label: macOS}
    - {id: linux, label: Linux}
    - {id: windows_wsl2, label: Windows (WSL2)}
    - {id: windows_powershell, label: "Windows (native, PowerShell)"}
    - {id: cloud, label: Cloud (hosted execution mode)}
    - {id: browser, label: Browser}
    - {id: vscode, label: VS Code}
    - {id: cli, label: CLI}
    - {id: api, label: API}
    - {id: sdk, label: SDK}
    - {id: ssh, label: SSH}

# -----------------------------------------------------------------------------
# Sources registry — claims reference these by id via `src`.
# -----------------------------------------------------------------------------
sources:
  hn_thread:            {url: "https://news.ycombinator.com/item?id=48892859", title: "Show HN: Clawk (HN thread)"}
  clawk_repo:           {url: "https://github.com/clawkwork/clawk", title: "Clawk README"}
  agentjail_repo:       {url: "https://github.com/LuD1161/agentjail", title: "agentjail README"}
  gondolin_docs:        {url: "https://earendil-works.github.io/gondolin/", title: "Gondolin documentation"}
  gondolin_repo:        {url: "https://github.com/earendil-works/gondolin", title: "Gondolin repo (verified 2026-07-14)"}
  gondolin_security:    {url: "https://github.com/earendil-works/gondolin/security", title: "Gondolin security design"}
  flar_repo:            {url: "https://github.com/swelljoe/flar", title: "flar README"}
  yoloai_repo:          {url: "https://github.com/kstenerud/yoloai", title: "yoloAI README"}
  virtdev_repo:         {url: "https://github.com/matheusmoreira/virtdev", title: "virtdev README"}
  exe_dev_site:         {url: "https://exe.dev/", title: "exe.dev site & docs"}
  exe_dev_pricing:      {url: "https://exe.dev/pricing", title: "exe.dev pricing"}
  exe_dev_blog:         {url: "https://blog.exe.dev/meet-exe.dev", title: "Meet exe.dev (blog)"}
  sprites_docs:         {url: "https://docs.sprites.dev/", title: "Fly.io Sprites docs"}
  agentcage_repo:       {url: "https://github.com/agentcage/agentcage", title: "agentcage README"}
  coderunner_repo:      {url: "https://github.com/instavm/coderunner", title: "InstaVM CodeRunner README"}
  instavm_blog:         {url: "https://instavm.io/blog/nixos-reproducible-dev-environments-on-instavm", title: "InstaVM NixOS sandboxes (blog)"}
  yolobox_repo:         {url: "https://github.com/finbarr/yolobox", title: "yolobox README & security model"}
  bitrise_rde:          {url: "https://bitrise.io/platform/remote-dev-environments", title: "Bitrise RDE product page & docs"}
  codespaces_docs:      {url: "https://github.com/features/codespaces", title: "GitHub Codespaces docs"}
  anthropic_sandboxing: {url: "https://www.anthropic.com/engineering/claude-code-sandboxing", title: "Anthropic: Claude Code sandboxing"}
  anthropic_containment: {url: "https://www.anthropic.com/engineering/how-we-contain-claude", title: "Anthropic: How we contain Claude"}
  codex_security:       {url: "https://learn.chatgpt.com/docs/agent-approvals-security", title: "OpenAI: Agent approvals & security"}
  codex_sandboxing:     {url: "https://learn.chatgpt.com/docs/sandboxing?surface=app", title: "OpenAI: Codex sandboxing docs"}
  byre_repo:            {url: "https://github.com/pjlsergeant/byre", title: "byre README"}
  paseo_docs:           {url: "https://paseo.sh/docs/providers", title: "Paseo providers docs"}
  skynot_repo:          {url: "https://github.com/tarsgate/skynot", title: "skynot README"}
  takeaicontrol_repo:   {url: "https://github.com/daitangio/take-ai-control", title: "take-ai-control README"}
  aide_repo:            {url: "https://github.com/jskswamy/aide/", title: "Aide README"}
  scratch_repo:         {url: "https://github.com/housecat-inc/scratch", title: "scratch README"}
  katsuobushi_repo:     {url: "https://github.com/cdata/katsuobushi/tree/main/lib/sandbox", title: "katsuobushi sandbox"}
  nix_mitm_repo:        {url: "https://github.com/riedel/nix-opencode-with-mitm", title: "nix-opencode-with-mitm README"}
  nono_repo:            {url: "https://github.com/nolabs-ai/nono", title: "nono README"}
  nono_site:            {url: "https://nono.sh/", title: "nono site"}
  nono_docs:            {url: "https://nono.sh/docs/llms.txt", title: "nono docs (llms.txt)"}
  leash_repo:           {url: "https://github.com/strongdm/leash", title: "Leash (strongDM) README"}
  leash_disclaimer:     {url: "https://raw.githubusercontent.com/strongdm/leash/main/DISCLAIMER.txt", title: "Leash DISCLAIMER.txt"}
  claude_code_sandbox_docs: {url: "https://code.claude.com/docs/en/sandboxing", title: "Claude Code docs: Configure the sandboxed Bash tool (post-migration canonical doc)"}
  claude_code_security_docs: {url: "https://code.claude.com/docs/en/security", title: "Claude Code docs: Security"}
  anthropic_trust_center: {url: "https://trust.anthropic.com", title: "Anthropic Trust Center"}
  exe_dev_docs:         {url: "https://exe.dev/docs/integrations", title: "exe.dev docs: Integrations"}
  user_email_2026_07_20: {url: null, title: "User-submitted comparison, private email, 2026-07-20 (not part of the HN thread)"}
  greywall_repo:        {url: "https://github.com/GreyhavenHQ/greywall", title: "Greywall README"}
  greywall_site:        {url: "https://greywall.io/", title: "Greywall site"}
  greywall_docs:        {url: "https://docs.greywall.io/greywall", title: "Greywall docs: Install & Platform Support"}
  greywall_agent_profiles_tree: {url: "https://github.com/GreyhavenHQ/greywall/tree/main/internal/profiles/agents", title: "Greywall repo: internal/profiles/agents (verified 2026-07-20)"}
  greywall_credentials: {url: "https://docs.greywall.io/greywall/credential-protection", title: "Greywall docs: Credential Protection"}
  greyhaven_origin_post: {url: "https://greyhaven.co/insights/why-we-built-our-own-sandboxing-system", title: "Greyhaven: Why we built our own sandboxing system"}
  greywall_github_api:  {url: "https://api.github.com/repos/GreyhavenHQ/greywall", title: "GreyhavenHQ/greywall GitHub API metadata (verified 2026-07-20)"}
  agent_research_2026_07_20: {url: null, title: "Follow-up research triggered by investigating Greywall's stated influences, 2026-07-20 session"}
  fence_repo:           {url: "https://github.com/fencesandbox/fence", title: "Fence README (moved from github.com/Use-Tusk/fence)"}
  fence_why:            {url: "https://github.com/fencesandbox/fence/blob/main/docs/why-fence.md", title: "Fence docs: Why Fence (design philosophy & explicit non-goals)"}
  fence_architecture:   {url: "https://github.com/fencesandbox/fence/blob/main/ARCHITECTURE.md", title: "Fence ARCHITECTURE.md"}
  fence_agents_docs:    {url: "https://github.com/fencesandbox/fence/blob/main/docs/agents.md", title: "Fence docs: supported coding agents"}
  fence_configuration_docs: {url: "https://github.com/fencesandbox/fence/blob/main/docs/configuration.md", title: "Fence docs: configuration (templates, denied-credential rules)"}
  fence_github_api:     {url: "https://api.github.com/repos/fencesandbox/fence", title: "fencesandbox/fence GitHub API metadata (verified 2026-07-20)"}
  user_submitted_links_2026_07_20: {url: null, title: "User-submitted URLs (Databricks blog + Omnibox docs), pasted directly in session, 2026-07-20 (not part of the HN thread)"}
  omnigent_databricks_blog: {url: "https://www.databricks.com/blog/introducing-omnigent-meta-harness-combine-control-and-share-your-agents", title: "Databricks blog: Introducing Omnigent"}
  omnigent_docs_omnibox: {url: "https://omnigent.ai/docs/omnibox", title: "Omnigent docs: Omnibox"}
  omnigent_repo:        {url: "https://github.com/omnigent-ai/omnigent", title: "omnigent-ai/omnigent README & source (verified 2026-07-20)"}
  omnigent_github_api:  {url: "https://api.github.com/repos/omnigent-ai/omnigent", title: "omnigent-ai/omnigent GitHub API metadata (verified 2026-07-20)"}
  discobox_repo:        {url: "https://github.com/discobox-ai/discobox", title: "Discobox README (verified at commit 4a7f956, 2026-10-01)"}
  discobox_adr_userns:  {url: "https://github.com/discobox-ai/discobox/blob/4a7f956d65f44080c4c3cc6575ce3aa72001bed0/docs/adr/0004-user-namespaces-are-the-default-isolation.md", title: "Discobox ADR 0004: user namespaces as default isolation (Status: Proposed)"}
  discobox_proxy:       {url: "https://github.com/discobox-ai/discobox/blob/4a7f956d65f44080c4c3cc6575ce3aa72001bed0/proxy/DESIGN.md", title: "Discobox proxy design (destination policy, MITM, sentinel swap)"}
  discobox_vz:          {url: "https://github.com/discobox-ai/discobox/blob/4a7f956d65f44080c4c3cc6575ce3aa72001bed0/server/providers/vz/provider.go", title: "Discobox source: macOS vz pool VM, /Users exported read-only"}
  discobox_installer:   {url: "https://github.com/discobox-ai/discobox/blob/4a7f956d65f44080c4c3cc6575ce3aa72001bed0/installer/install.sh", title: "Discobox install script (refuses Intel Macs)"}
  inclusion_request_2026_10_01: {url: null, title: "Inclusion request for Discobox sent to the dataset maintainer, 2026-10-01 (not part of the HN thread)"}
  docker_sandboxes_docs:       {url: "https://docs.docker.com/ai/sandboxes/", title: "Docker Sandboxes documentation"}
  docker_sandboxes_security:   {url: "https://docs.docker.com/ai/sandboxes/security/", title: "Docker Sandboxes security model"}
  docker_sandboxes_architecture: {url: "https://docs.docker.com/ai/sandboxes/architecture/", title: "Docker Sandboxes architecture"}
  docker_sandboxes_agents:     {url: "https://docs.docker.com/ai/sandboxes/agents/", title: "Docker Sandboxes supported agents"}
  docker_sandboxes_install:    {url: "https://docs.docker.com/ai/sandboxes/install/", title: "Docker Sandboxes installation guide"}
  docker_sandboxes_defaults:   {url: "https://docs.docker.com/ai/sandboxes/security/defaults", title: "Docker Sandboxes default security posture"}
  docker_sandboxes_release_notes: {url: "https://docs.docker.com/ai/sandboxes/release-notes/", title: "Docker Sandboxes release notes"}
  docker_sandboxes_local_policy: {url: "https://docs.docker.com/ai/sandboxes/governance/access-controls/local/", title: "Docker Sandboxes local network policy presets"}
  docker_sandboxes_faq:        {url: "https://docs.docker.com/ai/sandboxes/faq/", title: "Docker Sandboxes FAQ"}
  contributor_submission_2026_08_28: {url: "https://github.com/pjlsergeant/ai-sandboxes/pull/2", title: "Contributor-submitted Docker Sandboxes entry, PR #2, 2026-08-28 (not part of the HN thread)"}

# -----------------------------------------------------------------------------
# UI hints. The decision funnel keys off documented fields only.
# -----------------------------------------------------------------------------
ui:
  primary_filters: [classification.isolation_boundary, classification.execution_locus,
                    classification.network_policy, classification.credential_mediation,
                    pricing.model, agents_supported, platforms]
  compare_view_row_order:
    - classification.isolation_boundary
    - classification.network_policy
    - classification.credential_mediation
    - classification.state_model
    - risk.stated_scope
    - risk.assessed_tiers
    - pricing.model
    - maturity
    - limitations
  evidence_rendering:
    official: plain text, source-linked
    thread: chip labeled "per HN commenters", source-linked
    editorial: chip labeled "our assessment", basis shown on hover/expand
    toggle_official_only: hide any claim whose effective ev != official
  decision_funnel:
    - question: What are you afraid of?
      maps_to: [risk.stated_scope, risk.assessed_tiers, classification.isolation_boundary]
      effect: Sets the minimum acceptable boundary strength (taxonomy.isolation_boundary.strength).
    - question: What will it cost you, in money and machine?
      maps_to: [pricing, classification.isolation_boundary, footprint_notes]
      effect: Boundary strength implies local footprint; pricing.model covers the monetary side.
    - question: Where must code run?
      maps_to: classification.execution_locus
      effect: Local ownership vs off-laptop persistence and concurrency.

# -----------------------------------------------------------------------------
# Principal sandboxes. Shorthand scalar = {ev: official, src: default_source}.
# -----------------------------------------------------------------------------
sandboxes:

  - id: clawk
    name: Clawk
    default_source: clawk_repo
    tagline: Disposable, network-restricted Linux VMs for coding agents.
    urls: {repo: "https://github.com/clawkwork/clawk"}
    license: Apache-2.0
    maturity: {value: pre_1_0_active, basis: Repo is pre-1.0 and under active development.}
    thread_status: {value: directly_linked, src: hn_thread}
    platforms:
      value: [macos, linux]
      basis: macOS first-class; Linux provider explicitly experimental.
    agents_supported: [claude_code, codex, opencode, generic_command_execution]
    classification:
      role: runtime
      execution_locus: local
      isolation_boundary: {value: vm, basis: Hypervisor-backed Linux guest per repo or multi-repo worktree.}
      state_model: {value: resumable, basis: VM disk disposable except snapshots; Linux provider adds disk persistence; repo and conversations live on host.}
      network_policy: {value: allowlist, basis: Outbound allowlist documented in README.}
      credential_mediation: {value: forwarded, basis: SSH-agent forwarding keeps private keys off the guest.}
    risk:
      stated_scope:
        value: [t1_accidents, t2_exfiltration, t3_hostile_escape]
        basis: README claims center on the VM boundary plus network allowlist, while stating that anything mounted or allowlisted is exposed to the agent.
      assessed_tiers:
        value: [t1_accidents, t2_exfiltration, t3_hostile_escape]
        ev: editorial
        derived_from: [classification.isolation_boundary, classification.network_policy, classification.credential_mediation]
        basis: Hypervisor boundary (official) + egress allowlist (official) + off-guest keys (official) plausibly cover all three tiers; no independent audit exists.
      design_intent:
        value: liberate
        basis: Product framing is giving agents a disposable VM instead of your laptop.
    pricing: {model: free_oss}
    footprint_notes:
      value: One VM per repo or multi-repo worktree.
      basis: Documented deployment unit; RAM/disk implications follow from the VM boundary, not from a stored rating.
    convenience_notes:
      - {value: Worktree workflow and ticket mode built in.}
    integrations: [oci_image_rootfs, git_worktrees, ticket_mode, cli]
    audience: [individual_developer, small_team]
    limitations:
      - {value: macOS-first; Linux path experimental.}
      - {value: Anything mounted or allowlisted is exposed to the agent.}
    compliance: {value: none_stated}

  - id: agentjail
    name: agentjail
    default_source: agentjail_repo
    tagline: Policy guardrails that check every agent tool call before it runs.
    urls: {repo: "https://github.com/LuD1161/agentjail"}
    license: Apache-2.0
    maturity: {value: early_active, basis: "v0.9.0 released 2026-07-16 (Monitor Mode, verified attestation, control-plane auth between daemon/netproxy/secrets-broker); still pre-1.0 and shipping rapidly."}
    thread_status: {value: directly_linked, src: hn_thread}
    platforms: [macos, linux]
    agents_supported: [claude_code, codex, cursor]
    classification:
      role: policy_wrapper
      execution_locus: local
      isolation_boundary: {value: os_sandbox, basis: Hook-based policy checks with optional kernel sandbox (agentjail-shield).}
      state_model: {value: resumable, basis: Per-project overlays and sessions; policies and daemon on host.}
      network_policy: {value: proxy_mediated, basis: Session-aware net proxy; opt-in / interim in some flows.}
      credential_mediation:
        value: host_side_injection
        basis: v0.6+ ships a credential broker and secrets vault; shield path strips ambient env; secrets role mediates access rather than leaving keys ambient in the agent environment.
    risk:
      stated_scope:
        value: [t1_accidents, t2_exfiltration]
        basis: README frames the goal as preventing unsafe tool calls before they run, with a fail-closed policy posture and defense in depth; it does not claim a VM boundary.
      assessed_tiers:
        value: [t1_accidents, t2_exfiltration]
        ev: editorial
        derived_from: [classification.isolation_boundary, classification.network_policy, classification.credential_mediation]
        basis: Policy + OS sandbox + proxy + credential broker address accidents and exfiltration; hostile escape is out of scope without a hypervisor boundary.
      design_intent:
        value: constrain
        basis: Every tool call is checked locally before it runs, per the repo description.
    pricing: {model: free_oss}
    footprint_notes:
      value: Runs as hooks and a host daemon; no VM or container required.
      basis: Documented architecture.
    convenience_notes:
      - {value: Stated goal includes reducing approval fatigue.}
    integrations: [hooks, opa_policies, mcp_scan, daemon, net_proxy_opt_in, secrets_broker, monitor_mode, control_plane_auth]
    audience: [individual_developer]
    limitations:
      - {value: Not a full VM.}
      - {value: Proxy path interim / opt-in in some flows.}
    compliance: {value: none_stated}

  - id: gondolin
    name: Gondolin
    default_source: gondolin_docs
    tagline: Local microVMs with a programmable (TypeScript) network and filesystem policy layer.
    urls: {repo: "https://github.com/earendil-works/gondolin", docs: "https://earendil-works.github.io/gondolin/", security: "https://github.com/earendil-works/gondolin/security"}
    license: {value: Apache-2.0, src: gondolin_repo}
    maturity: {value: experimental_active, src: gondolin_repo, basis: Self-described as experimental; @earendil-works/gondolin package at v0.12.0 as of mid-2026.}
    thread_status: {value: directly_linked, src: hn_thread}
    platforms: [macos, linux]
    agents_supported: [generic_command_execution, pi]
    classification:
      role: runtime
      execution_locus: local
      isolation_boundary: {value: microvm, basis: QEMU microVM by default; experimental libkrun backend.}
      state_model: {value: configurable, basis: Copy-on-write root disk; persistence governed by host-side VFS policy; custom images optional.}
      network_policy: {value: proxy_mediated, basis: Host-side JS network stack mediates traffic; allowlisting expressible in the policy layer.}
      credential_mediation: {value: host_side_injection, src: gondolin_repo, basis: Guest sees only a placeholder token; host injects the real secret solely for allowed destinations.}
    risk:
      stated_scope:
        value: [t1_accidents, t2_exfiltration, t3_hostile_escape]
        src: gondolin_security
        basis: Security design doc states an explicit threat model, and explicitly trusts the host Node process and QEMU boundary, with no full DoS isolation.
      assessed_tiers:
        value: [t1_accidents, t2_exfiltration, t3_hostile_escape]
        ev: editorial
        derived_from: [classification.isolation_boundary, classification.network_policy, classification.credential_mediation]
        basis: MicroVM boundary + mediated egress + host-side secret injection cover all three tiers within the stated trust assumptions.
      design_intent:
        value: both
        ev: editorial
        basis: Programmable policy layer supports both gating (constrain) and walled autonomy (liberate); docs do not pick a side.
    pricing: {model: free_oss}
    footprint_notes:
      value: MicroVM per sandbox with copy-on-write root disk.
      basis: Documented architecture.
    convenience_notes:
      - {value: Early-stage ergonomics acknowledged in its own docs.}
    integrations: [typescript_policy_layer, vfs_providers, custom_images, pi_extension]
    audience: [platform_builder, individual_developer]
    limitations:
      - {value: Trusts host Node process and QEMU boundary., src: gondolin_security}
      - {value: No full DoS isolation., src: gondolin_security}
    compliance: {value: none_stated}

  - id: flar
    name: flar
    default_source: flar_repo
    tagline: Fast, light Bubblewrap-based agent restriction with minimal startup overhead.
    urls: {repo: "https://github.com/swelljoe/flar"}
    license: Apache-2.0
    maturity: {value: very_early, basis: "No published releases at fetch time, per its own README."}
    thread_status: {value: directly_linked, src: hn_thread}
    platforms: [linux]
    agents_supported: {value: [claude_code, antigravity, codex, copilot, reasonix, kimi_code], basis: "Kimi Code added via PR #3, merged 2026-07-17."}
    classification:
      role: runtime
      execution_locus: local
      isolation_boundary: {value: os_sandbox, basis: Bubblewrap in an unprivileged user namespace; read-only system paths; project bind mount.}
      state_model: {value: resumable, basis: Temporary copied config plus bound per-project transcript stores; host config untouched.}
      network_policy: {value: configurable, basis: Isolated by default with optional host/shared network.}
      credential_mediation: {value: mounted, basis: Config is copied in; the chosen agent's credential token remains accessible to that agent.}
    risk:
      stated_scope:
        value: [t1_accidents]
        basis: README markets tighter-than-in-agent sandboxing but is candid that the project is far less tested and that the agent's own token stays reachable.
      assessed_tiers:
        value: [t1_accidents]
        ev: editorial
        derived_from: [classification.credential_mediation, classification.isolation_boundary]
        basis: In-runtime token access undermines the exfiltration tier; OS-sandbox boundary is below hypervisor grade.
      design_intent:
        value: constrain
        basis: A restrictor by name and framing.
    pricing: {model: free_oss}
    footprint_notes:
      value: Namespace-based; minimal startup overhead is the stated point of the project.
      basis: README framing (Fast Light Agent Restrictor).
    convenience_notes:
      - {value: Session seeding / shadow homes; host-side proxy.}
    integrations: [host_side_proxy, config_copying, session_seeding_shadow_homes]
    audience: [individual_developer]
    limitations:
      - {value: Linux-only.}
      - {value: "Far less tested, per its own README; no releases at fetch time."}
      - {value: Agent's own credential token reachable by that agent.}
    compliance: {value: none_stated}

  - id: yoloai
    name: yoloAI
    default_source: yoloai_repo
    tagline: One sandbox wrapper across many backends, with a copy/diff/apply review workflow.
    urls: {repo: "https://github.com/kstenerud/yoloai"}
    license: MIT
    maturity: {value: public_beta}
    thread_status: {value: directly_linked, src: hn_thread}
    platforms: [linux, macos, windows_wsl2]
    agents_supported: [claude_code, codex, gemini_cli, aider, opencode, generic_command_execution]
    classification:
      role: runtime
      execution_locus: local
      isolation_boundary:
        value: layered
        basis: Backends span Docker, Podman, containerd/Kata, Apple container, Tart, Seatbelt; isolation modes from namespaces through gVisor to Kata/Firecracker.
      state_model: {value: copy_apply, basis: Sandbox changes are reviewed with diff and applied; state lives in ~/.yoloai/.}
      network_policy: {value: configurable, basis: Documented open / allowlist / none modes.}
      credential_mediation:
        value: host_side_injection
        basis: Credential brokering documented, but provider-specific rather than universal; otherwise mounted.
    risk:
      stated_scope:
        value: [t1_accidents, t2_exfiltration]
        basis: README claims no ambient data, credential brokering, and network none/allowlist modes.
      assessed_tiers:
        value: [t1_accidents, t2_exfiltration, t3_hostile_escape]
        ev: editorial
        derived_from: [classification.isolation_boundary, classification.network_policy]
        basis: Tier credibility depends on the chosen backend — namespaces reach t1; Kata/Firecracker backends are t3-grade.
      design_intent:
        value: both
        ev: editorial
        basis: Copy/diff/apply gates changes (constrain) while backends enable walled autonomy (liberate).
    pricing: {model: free_oss}
    footprint_notes:
      value: Footprint tracks the chosen backend, from shared-kernel namespaces to Firecracker microVMs.
      basis: Documented backend list.
    convenience_notes:
      - {value: Diff/apply adds a review step to every change in exchange for safety., ev: editorial, derived_from: [classification.state_model], basis: Direct implication of the documented copy/diff/apply workflow.}
    integrations: [go_api, mcp_bidirectional, vscode_tunnel, profiles, extensions]
    audience: [individual_developer]
    limitations:
      - {value: Complexity from many backends., ev: thread, src: hn_thread}
      - {value: Credential brokering not universal across providers.}
    compliance: {value: none_stated}

  - id: virtdev
    name: virtdev
    default_source: virtdev_repo
    tagline: Per-project Arch Linux KVM/QEMU VMs with nftables egress zones.
    urls: {repo: "https://github.com/matheusmoreira/virtdev"}
    license: AGPL-3.0
    maturity: {value: active_personal_project}
    thread_status: {value: directly_linked, src: hn_thread}
    platforms: {value: [linux], basis: "Requires an Arch Linux host specifically, not just any Linux distro."}
    agents_supported:
      value: [agent_agnostic, claude_code]
      basis: "Agent-agnostic in general; Claude Code is mentioned only as a passing example (\"wan is the usual working zone (package managers, Claude Code)\"), not documented as a first-class integration."
    classification:
      role: runtime
      execution_locus: local
      isolation_boundary: {value: vm, basis: "KVM/QEMU virtual machines, locked by default."}
      state_model: {value: persistent, basis: Shared sealed base image with per-project qcow2 deltas.}
      network_policy: {value: configurable, basis: nftables egress zones via passt — none/wan/lan/full plus optional custom single-port holes; default zone is none (no network beyond SSH).}
      credential_mediation: unspecified
    risk:
      stated_scope:
        value: [t1_accidents, t3_hostile_escape]
        basis: Security focus documented as hypervisor boundary plus egress zones; no built-in policy engine or secret injection yet.
      assessed_tiers:
        value: [t1_accidents, t3_hostile_escape]
        ev: editorial
        derived_from: [classification.isolation_boundary, classification.network_policy, classification.credential_mediation]
        basis: Hypervisor boundary and zoning are strong, but with credential handling unspecified, exfiltration protection depends entirely on what the user places in the VM and which zone they choose.
      design_intent:
        value: liberate
        ev: editorial
        basis: Walled per-project VMs for autonomous work; no per-call gating layer.
    pricing: {model: free_oss}
    footprint_notes:
      value: Full VM per project, deduplicated via a shared sealed base plus qcow2 deltas.
      basis: Documented storage architecture.
    convenience_notes:
      - {value: Root needed at least once to apply the firewall.}
    integrations: [cli, custom_zones, user_mode_systemd]
    audience: [linux_power_user]
    limitations:
      - {value: Arch-host requirement.}
      - {value: Credential injection not yet built in.}
    compliance: {value: none_stated}

  - id: exe_dev
    name: exe.dev
    default_source: exe_dev_site
    tagline: Hosted persistent Linux VMs that keep working when your laptop is closed.
    urls: {official: "https://exe.dev/", pricing: "https://exe.dev/pricing", blog: "https://blog.exe.dev/meet-exe.dev"}
    license: proprietary_service
    maturity: {value: public_service, basis: Active docs and pricing; developer-preview origins.}
    thread_status: {value: mentioned_in_report_sources, src: hn_thread}
    platforms: [browser, ssh, vscode]
    agents_supported:
      value: [claude_code, codex, pi, shelley, agent_agnostic]
      basis: Official Running Agents docs accessed 2026-07-14 state that Claude, Codex, Pi, and Shelley are preinstalled on newly created VMs; other agents can also be installed and run.
    classification:
      role: runtime
      execution_locus: vendor_cloud
      isolation_boundary: {value: vm, basis: "Full hosted Linux VMs with root, apt/systemd, HTTPS proxy, and SSH access."}
      state_model: {value: persistent, basis: Persistent disks; disks backed up; stopped VMs keep their disk.}
      network_policy: {value: operator_managed, basis: VMs private by default; access via proxy/SSH; integrations govern reachability.}
      credential_mediation:
        value: managed_integration
        src: exe_dev_docs
        basis: "Integrations docs describe network-level secret injection that keeps tokens off the VM: GitHub Integration avoids VM-side tokens, AWS/GCP Workload Identity Federation issues short-lived OIDC credentials rather than placing access keys on the VM, and an LLM Gateway removes the need for API keys on the VM."
    risk:
      stated_scope:
        value: [t1_accidents, t3_hostile_escape]
        basis: Claims include private-by-default access, real VMs, maintained images, and no exposed ports by default.
      assessed_tiers:
        value: [t1_accidents, t3_hostile_escape]
        ev: editorial
        derived_from: [classification.isolation_boundary, classification.credential_mediation]
        basis: "Full VM boundary is credible for accidents and hostile escape; exfiltration tier remains unassessed by default because Integrations-mediated credentials (GitHub, AWS/GCP WIF, LLM Gateway) only cover secrets routed through those specific connectors, general VM egress has no documented allowlist/policy, and the vendor sits inside the trust boundary."
      design_intent:
        value: liberate
        ev: editorial
        basis: Persistent off-laptop VMs for agents to work in unattended.
    pricing:
      model: paid_subscription
      src: exe_dev_pricing
      notes: {value: Subscription plus usage-based options.}
    footprint_notes:
      value: Runs on vendor hardware; local footprint is zero, cost is monetary.
      basis: Managed-service model.
    convenience_notes:
      - {value: "Maintained images; VS Code, regions, GitHub and proxy integrations."}
    integrations: [ssh_api, https_api, github, http_proxy, llm_integrations, reflection, regions, vscode, agent_skill]
    audience: [individual_developer, small_team]
    limitations:
      - {value: Not self-hostable.}
      - {value: Region tied per account.}
    compliance: {value: none_stated_in_fetched_docs}

  - id: fly_sprites
    name: Fly.io Sprites
    default_source: sprites_docs
    tagline: Persistent, hardware-isolated Firecracker microVM "sandbox computers."
    urls: {official: "https://sprites.dev/", docs: "https://docs.sprites.dev/"}
    license: proprietary_service
    maturity: {value: new_official_product, basis: Docs described as work-in-progress early on.}
    thread_status: {value: mentioned_only, src: hn_thread}
    platforms: [api, cli, sdk]
    agents_supported:
      value: [agent_agnostic, claude_code, moltbot]
      basis: "Agent-agnostic generally; Claude Code and Moltbot (Clawdbot) are documented via a dedicated reference-implementation repo and a blog post respectively, not confirmed preinstalled/first-class the way exe.dev documents its agents."
    classification:
      role: runtime
      execution_locus: vendor_cloud
      isolation_boundary: {value: microvm, basis: Hardware-isolated Firecracker microVMs with private filesystems and networking.}
      state_model: {value: persistent, basis: Filesystem and memory persist between runs; sleep when idle; checkpoints and restore.}
      network_policy:
        value: configurable
        basis: Outbound is unrestricted by default; an opt-in DNS-based allowlist policy can tighten egress from outside the Sprite.
      credential_mediation:
        value: managed_integration
        basis: Connectors route external API calls through a gateway that holds tokens for the Sprite; not ambient in-guest secrets by default for those paths. General secret handling beyond Connectors is lightly documented.
    risk:
      stated_scope:
        value: [t1_accidents, t3_hostile_escape]
        basis: Strong isolation claims for arbitrary and user-submitted code; optional DNS egress policy and Connectors for credentialed egress.
      assessed_tiers:
        value: [t1_accidents, t3_hostile_escape]
        ev: editorial
        derived_from: [classification.isolation_boundary, classification.network_policy]
        basis: Firecracker boundary covers accidents and hostile escape; default-open egress means t2 is configuration-dependent (apply network policy + Connectors), so it is not assessed by default.
      design_intent:
        value: liberate
        ev: editorial
        basis: Built as a platform primitive for hosting agent runtimes and untrusted code.
    pricing:
      model: paid_usage
      notes: {value: Usage-based; idle sleep limits standing cost.}
    footprint_notes:
      value: Vendor hardware; sleep-when-idle and checkpoint/restore documented.
      basis: Sprites docs.
    convenience_notes:
      - {value: Checkpoint and restore; JS and Go SDKs.}
    integrations: [cli, rest_api, js_sdk, go_sdk, network_policies, connectors]
    audience: [platform_builder, individual_developer]
    limitations:
      - {value: Managed service only.}
      - {value: Outbound unrestricted until an egress policy is applied.}
      - {value: Operational limits and region selection still evolving.}
      - {value: "https://sprites.dev/ now 301-redirects to https://fly.io/sprites (product fully absorbed into Fly.io's own branding); docs.sprites.dev is unaffected and remains independent.", ev: editorial, basis: Observed 2026-07-20.}
    compliance: {value: none_stated_in_fetched_docs}

  - id: agentcage
    name: agentcage
    default_source: agentcage_repo
    tagline: Defense-in-depth sandbox with an inspecting, fail-closed proxy against exfiltration.
    urls: {repo: "https://github.com/agentcage/agentcage"}
    license: MIT
    maturity: {value: experimental, basis: README warns the project is experimental and not audited; many releases.}
    thread_status: {value: directly_linked, src: hn_thread}
    platforms: [macos, linux]
    agents_supported: [claude_code, codex, pi, openclaw]
    classification:
      role: runtime
      execution_locus: local
      isolation_boundary:
        value: layered
        basis: Rootless Podman container, Lima VM, or Apple-container microVM backend, plus internal-only network, inspecting proxy, and DNS sidecar.
      state_model: {value: ephemeral, basis: Ephemeral sessions tear down but preserve audit logs; persistent cages optional and keep auth.}
      network_policy: {value: proxy_mediated, basis: Inspecting proxy with fail-closed traffic default.}
      credential_mediation: {value: host_side_injection, basis: Secret scanning plus placeholder injection with outbound substitution.}
    risk:
      stated_scope:
        value: [t1_accidents, t2_exfiltration]
        basis: Explicit exfiltration-blocking design — placeholders, fail-closed traffic, audit logs — alongside an explicit not-audited warning.
      assessed_tiers:
        value: [t1_accidents, t2_exfiltration]
        ev: editorial
        derived_from: [classification.isolation_boundary, classification.credential_mediation]
        basis: Exfiltration is the design center; escape-tier credibility depends on which backend (container vs VM) is chosen.
      design_intent:
        value: constrain
        basis: Every outbound byte passes an inspecting, fail-closed proxy.
    pricing: {model: free_oss}
    footprint_notes:
      value: Adds proxy and DNS sidecar processes on top of the chosen backend.
      basis: Documented architecture.
    convenience_notes:
      - {value: Operational complexity is the acknowledged trade for depth.}
    integrations: [cli, scaffolds, custom_inspectors, cage_audit_logs, config_driven_cages]
    audience: [security_minded_developer, operator]
    limitations:
      - {value: "Not audited; experimental, per its own README."}
    compliance: {value: none_stated}

  - id: instavm_coderunner
    name: InstaVM CodeRunner
    default_source: coderunner_repo
    tagline: Local Apple-container sandbox for AI agents on Apple Silicon, with a cloud path.
    urls: {repo: "https://github.com/instavm/coderunner", related_blog: "https://instavm.io/blog/nixos-reproducible-dev-environments-on-instavm"}
    license: Apache-2.0
    maturity: {value: active_company_backed}
    thread_status: {value: directly_linked, src: hn_thread}
    platforms:
      value: [macos]
      basis: "Apple Silicon (M1/M2/M3/M4) specifically — the Apple container runtime requires it; Intel Macs are not supported."
    agents_supported: {value: [claude_code, agent_agnostic], basis: "Claude Code named explicitly; broader agent support stated without an exact engine list."}
    classification:
      role: runtime
      execution_locus: local
      isolation_boundary: {value: microvm, basis: Apple container runtime / VM-level isolation.}
      state_model:
        value: resumable
        basis: Documented stop/start preserves uploads, kernels, and installed packages in the same container; delete + reinstall for a clean slate.
      network_policy: unspecified
      credential_mediation: unspecified
    risk:
      stated_scope:
        value: [t1_accidents]
        basis: Claims 100% local execution and zero cloud uploads for local testing; no documented network or credential posture.
      assessed_tiers:
        value: [t1_accidents, t3_hostile_escape]
        ev: editorial
        derived_from: [classification.isolation_boundary]
        basis: VM-level isolation supports containment tiers, but exfiltration credibility cannot be assessed with network and credential posture unspecified.
      design_intent:
        value: liberate
        ev: editorial
        basis: A box to run agents in, not a per-call gate.
    pricing: {model: free_oss}
    footprint_notes:
      value: Apple-container VM per sandbox on Apple Silicon.
      basis: Documented runtime.
    convenience_notes: []
    integrations: [coderunner_ui, instavm_ecosystem, cloud_compatible_workflow, mcp_server]
    audience: [mac_developer]
    limitations:
      - {value: Apple-centric.}
      - {value: Fetched sources light on network and credential policy detail., ev: editorial, basis: Comparative observation across this dataset's entries.}
    compliance: {value: none_stated}

  - id: yolobox
    name: yolobox
    default_source: yolobox_repo
    tagline: Let the agent work freely inside a container; keep your home directory out of it.
    urls: {repo: "https://github.com/finbarr/yolobox"}
    license: MIT
    maturity: {value: active_0x}
    thread_status: {value: directly_linked, src: hn_thread}
    platforms: [macos, linux]
    agents_supported:
      value: [claude_code, codex, kimi_code, gemini_cli, antigravity, opencode, copilot, pi, agent_agnostic]
      basis: First-class CLI shortcuts documented for Claude, Codex, Kimi Code, Gemini, Antigravity, OpenCode, Copilot, and Pi (Claude/Codex/Kimi Code get built-in yolobox guidance); shell/run cover other harnesses.
    classification:
      role: runtime
      execution_locus: local
      isolation_boundary: {value: container, basis: Container-based; agent gets sudo inside the container.}
      state_model: {value: persistent, basis: Named volumes preserve setup across sessions.}
      network_policy: {value: open, basis: Open network by default; --no-network available per command.}
      credential_mediation: {value: mounted, basis: "Passed-in secrets are exposed to the agent, per its own security notes."}
    risk:
      stated_scope:
        value: [t1_accidents]
        basis: README is explicit that it protects against accidents more than hostile-code escape, and recommends rootless Podman or a VM for tighter threat models.
      assessed_tiers:
        value: [t1_accidents]
        ev: editorial
        derived_from: [risk.stated_scope]
        basis: Matches the vendor's own honest scoping; no reason to assess beyond it.
      design_intent:
        value: liberate
        basis: The product's framing is letting the agent run freely inside the box.
    pricing: {model: free_oss}
    footprint_notes:
      value: Single shared-kernel container with named volumes.
      basis: Documented architecture.
    convenience_notes:
      - {value: One-command ergonomics with hardening options documented.}
    integrations: [cli_flags, hardening_options, security_model_docs]
    audience: [individual_developer]
    limitations:
      - {value: Not positioned as a strong escape barrier.}
      - {value: Project dir and passed-in secrets remain exposed.}
      - {value: Open network by default.}
    compliance: {value: none_stated}

  - id: bitrise_rde
    name: Bitrise Remote Dev Environments
    default_source: bitrise_rde
    tagline: Hosted isolated VMs (macOS and Linux) for remote dev and agent sessions on CI infrastructure.
    urls: {official: "https://bitrise.io/platform/remote-dev-environments"}
    license: proprietary_service
    maturity: {value: beta, basis: Product page positions RDE as in beta with free trial / talk-to-us packaging.}
    thread_status: {value: directly_linked, src: hn_thread}
    platforms: {value: [macos, linux], basis: "Vendor-hosted macOS and Linux cloud environments on Bitrise CI stacks — hosting model is already captured by classification.execution_locus: vendor_cloud; these ids denote OS only."}
    agents_supported: {value: [claude_code, codex, gemini_cli, mcp_orchestrated], basis: "Product page lists Claude Code, Codex, Gemini CLI, and MCP-orchestrated agents among supported tools."}
    classification:
      role: remote_workspace
      execution_locus: vendor_cloud
      isolation_boundary: {value: vm, basis: Cloud VMs on the same stacks/caches as Bitrise CI; one machine per task.}
      state_model: {value: persistent, basis: Persistent on-demand VMs; sessions can be archived and restored.}
      network_policy: operator_managed
      credential_mediation:
        value: unspecified
        basis: Product page says credentials are scoped to the session and agents use user-supplied API keys; that is lifetime/scope control, not documented mediation that keeps secrets off the guest (managed_integration).
    risk:
      stated_scope:
        value: [t1_accidents, t3_hostile_escape]
        basis: Security framing emphasizes per-session isolation and the same posture as Bitrise CI infrastructure; public page does not document egress or host-side secret injection for agents.
      assessed_tiers:
        value: [t1_accidents, t3_hostile_escape]
        ev: editorial
        derived_from: [classification.isolation_boundary, classification.credential_mediation]
        basis: VM isolation is credible for accidents and hostile escape; t2 left unasserted because session-scoped keys still land with the agent and egress control is not documented on the public page; vendor sits inside the trust boundary.
      design_intent:
        value: liberate
        ev: editorial
        basis: Off-laptop machines for agents to work in, one per task.
    pricing:
      model: contact_sales
      notes: {value: Product page offers free trial and says talk-to-us for fit; packaging still in flux during beta.}
    footprint_notes:
      value: Vendor hardware, including cloud macOS — rare in this space.
      basis: Product page.
    convenience_notes:
      - {value: "SSH, VNC, web terminal, VS Code plugin, MCP server, API."}
    integrations: [cli, web_ui, mcp_server, api, vscode_plugin, ssh, vnc, web_terminal]
    audience: [team, mobile_team, enterprise]
    limitations:
      - {value: Pricing/packaging moving during beta.}
      - {value: No self-hosted RDE equivalent surfaced., ev: editorial, basis: Not found in fetched sources; Bitrise supports on-prem runners for builds generally.}
    compliance: {value: none_stated_for_rde_specifically}

  - id: github_codespaces
    name: GitHub Codespaces
    default_source: codespaces_docs
    tagline: Hosted VM + devcontainer dev environments, commonly repurposed as agent sandboxes.
    urls: {official: "https://github.com/features/codespaces"}
    license: proprietary_service
    maturity: {value: mature_ga}
    thread_status: {value: directly_linked, src: hn_thread}
    platforms: [browser, vscode]
    agents_supported: [agent_agnostic]
    classification:
      role: remote_workspace
      execution_locus: vendor_cloud
      isolation_boundary: {value: layered, basis: Development container hosted on a VM; isolated virtual network per codespace.}
      state_model: {value: persistent, basis: "Saved changes persist across stops; 30-minute idle timeout default; inactive stopped codespaces delete after 30 days by default, configurable."}
      network_policy: {value: open, basis: Outbound internet allowed by default.}
      credential_mediation: {value: unspecified, basis: Standard GitHub secrets model; no agent-native mediation story documented.}
    risk:
      stated_scope:
        value: [t1_accidents]
        basis: Official docs claim isolated virtual networking and enterprise auditability; positioning is dev environments, not agent safety.
      assessed_tiers:
        value: [t1_accidents, t3_hostile_escape]
        ev: editorial
        derived_from: [classification.isolation_boundary, classification.network_policy]
        basis: The VM contains damage to the codespace, but open outbound by default and no agent-native secret mediation leave the exfiltration tier unaddressed.
      design_intent:
        value: liberate
        ev: editorial
        basis: A general dev environment repurposed as a wall, with no agent gating layer.
    pricing:
      model: free_tier_plus_usage
      notes: {value: "Free allowance for individuals, then pay-as-you-go."}
    footprint_notes:
      value: Vendor hardware; prebuilds shorten startup at extra cost.
      basis: Codespaces docs.
    convenience_notes:
      - {value: "Devcontainer features, prebuilds, browser and VS Code access."}
    integrations: [rest_api, vscode, browser, devcontainer_features, prebuilds, octokit]
    audience: [individual_developer, team, enterprise]
    limitations:
      - {value: Not self-hostable.}
      - {value: Outbound internet allowed by default.}
      - {value: "Isolation is dev-environment-grade, not agent-specific safety control.", ev: editorial, derived_from: [classification.network_policy, classification.credential_mediation], basis: "No egress policy or credential mediation aimed at agent threat models."}
    compliance: {value: inherits_github_enterprise_posture}

  - id: claude_code_sandbox
    name: Claude Code sandbox
    default_source: claude_code_sandbox_docs
    tagline: OS-native sandboxing built into Claude Code for safer autonomy with fewer prompts.
    urls: {docs: "https://code.claude.com/docs/en/sandboxing", engineering: "https://www.anthropic.com/engineering/claude-code-sandboxing", containment: "https://www.anthropic.com/engineering/how-we-contain-claude"}
    license: product_feature
    maturity:
      value: mature_no_beta_label
      ev: editorial
      basis: "As of 2026-07-20, the current canonical docs (code.claude.com/docs/en/sandboxing) no longer label the built-in sandboxed Bash tool beta or research preview; that label now applies only to the separate, standalone @anthropic-ai/sandbox-runtime package (which wraps the whole Claude Code process, not just Bash). The 2026 engineering post's beta wording described that earlier, narrower rollout. Anthropic does not explicitly call the built-in tool GA either — this is an absence of a beta label, not a confirmed GA announcement. Cross-checked independently via codex CLI, which reached the same conclusion."
    thread_status: {value: directly_linked, src: hn_thread}
    platforms: {value: [macos, linux, windows_wsl2], basis: "Seatbelt on macOS; Bubblewrap on both Linux and WSL2. WSL1 and native Windows are not supported."}
    agents_supported: [claude_code]
    classification:
      role: runtime_feature
      execution_locus: local
      isolation_boundary: {value: os_sandbox, basis: "OS-native filesystem and network sandboxing — Seatbelt on macOS, Bubblewrap on Linux and WSL2."}
      state_model: {value: persistent, basis: Local repo/workspace state persists; sandbox applies to bash commands and FS/network boundaries.}
      network_policy: {value: configurable, basis: Sandbox-configured network boundaries.}
      credential_mediation:
        value: ambient
        basis: "Sandboxed Bash commands inherit the parent process environment by default, including any credentials set there — the default read policy also still allows reading files like ~/.aws/credentials or ~/.ssh/. The optional sandbox.credentials setting can `deny` reads/unset specific env vars, or `mask` an env var behind a sentinel value that a TLS-terminating egress proxy substitutes for the real secret only on requests to allowed hosts — but neither is the default, and there is no OS keyring/keychain-based mediation of secrets by the sandbox feature itself (that mechanism does not appear in the current docs; it does not exist). Independently confirmed via codex CLI."
    risk:
      stated_scope:
        value: [t1_accidents, t2_exfiltration]
        basis: Anthropic ties sandboxing to working-directory boundaries, network controls, and reduced permission prompts.
      assessed_tiers:
        value: [t1_accidents, t2_exfiltration]
        ev: editorial
        derived_from: [classification.isolation_boundary, classification.network_policy]
        basis: "OS sandbox plus default-deny-then-prompt network controls address accidents and exfiltration; not a hypervisor boundary. Credentials are ambient by default (ambient env inheritance, deny/mask are opt-in), so this tier's credibility rests on the network boundary and user-configured sandbox.credentials rules, not on any built-in credential mediation."
      design_intent:
        value: both
        basis: Stated goal is safer autonomy with fewer permission prompts — gating and liberation together.
    pricing: {model: product_feature, notes: {value: Bundled with Claude Code; product pricing not in fetched sources.}}
    footprint_notes:
      value: OS-sandbox primitives; no VM or container overhead.
      basis: Documented mechanism.
    convenience_notes:
      - {value: "Reduces permission prompts, per Anthropic's stated design goal."}
      - {value: Zero-install for existing Claude Code users., ev: editorial, basis: It is a feature of the product the user already runs.}
    integrations: [ide_integrations, permissions_system, devcontainer_guidance, agent_sdk, managed_agents_docs]
    audience: [claude_code_users]
    compliance:
      value: not_referenced_in_these_sources_trust_center_exists_separately
      ev: editorial
      src: anthropic_containment
      basis: "Neither cited engineering post references any active trust-center certification for this specific sandbox feature (no SOC 2, ISO 27001, etc). The containment post's only certification-adjacent mention is ISO/IEC 42001, named in a forward-looking \"Looking ahead\" section as an external AI-management standard the industry should develop toward, not something claimed as already held. This is scoped to these two posts only: Anthropic does maintain a separate Trust Center (trust.anthropic.com) documenting an actual SOC 2 Type II report and ISO 27001 certificate at the company level, per code.claude.com/docs/en/security — that just isn't what these two engineering posts discuss. Independently confirmed via codex CLI, grok CLI, and direct fetches of all sources."
    limitations:
      - {value: Relies on the user approval model outside the sandbox.}
      - {value: Boundaries must be configured correctly.}

  - id: codex_sandbox
    name: Codex sandbox
    default_source: codex_security
    tagline: OS-native local sandboxing plus worktree and isolated cloud execution modes.
    urls: {docs: "https://learn.chatgpt.com/docs/sandboxing?surface=app", security: "https://learn.chatgpt.com/docs/agent-approvals-security"}
    license: product_feature
    maturity: {value: mature_product_docs}
    thread_status: {value: directly_linked, src: hn_thread}
    platforms: {value: [macos, linux, windows_wsl2, windows_powershell, cloud], basis: "Seatbelt on macOS, Bubblewrap on Linux/WSL, native Windows sandbox on PowerShell; cloud tasks in isolated cloud environments."}
    agents_supported: [codex]
    classification:
      role: runtime_feature
      execution_locus: {value: hybrid, basis: "Local, worktree, and cloud execution modes documented."}
      isolation_boundary: {value: os_sandbox, basis: OS-native sandboxing locally; isolated cloud environments for cloud tasks.}
      state_model: {value: configurable, basis: Local and worktree tasks run on your machine; cloud tasks run remotely; boundaries govern write scope.}
      network_policy: {value: configurable, basis: Default network off locally; managed network policy in enterprise guidance.}
      credential_mediation:
        value: unspecified
        basis: "The cited sandboxing and agent-approvals-security docs describe filesystem/network boundaries and approvals, but no sandbox-specific credential mediation mechanism. Codex's `cli_auth_credentials_store` config (auth.json vs OS keychain) governs where the CLI caches its OWN login credentials — that is unrelated to how the local sandbox mediates a project's secrets. Independently confirmed via codex CLI."
    risk:
      stated_scope:
        value: [t1_accidents, t2_exfiltration]
        basis: OpenAI documents sandboxing, approvals, network policies, and agent-native telemetry / audit trails.
      assessed_tiers:
        value: [t1_accidents, t2_exfiltration]
        ev: editorial
        derived_from: [classification.network_policy]
        basis: Default-off local network is a notably conservative exfiltration posture on its own; the local boundary remains OS-sandbox-grade rather than hypervisor-grade, and no sandbox-specific credential mediation is documented.
      design_intent:
        value: both
        basis: Approvals model (constrain) combined with sandboxed autonomous modes (liberate).
    pricing: {model: product_feature, notes: {value: Varies by surface; not in fetched sources.}}
    footprint_notes:
      value: OS-sandbox primitives locally; cloud tasks offloaded to vendor hardware.
      basis: Documented modes.
    convenience_notes:
      - {value: Native Windows sandbox support — rare in this space., ev: editorial, derived_from: [platforms], basis: Comparative observation across this dataset's entries.}
    integrations: [chatgpt_desktop, cli, ide_extension, sdk, app_server, mcp_server, github_action, third_party]
    audience: [individual_developer, team, enterprise]
    limitations:
      - {value: Pricing and some operational details vary by surface.}
      - {value: User must still choose a permissions posture.}
    compliance: {value: enterprise_guidance_documented}

  - id: byre
    name: byre
    default_source: byre_repo
    tagline: "Your favourite skills and creature comforts in a constrained agent environment around any folder"
    urls: {repo: "https://github.com/pjlsergeant/byre", docs: "https://getbyre.com/docs"}
    license: MIT
    maturity:
      value: young
      basis: "v1.1.0 released 2026-07-19. Its own README: \"byre is a young project. I spend all day, every day inside it\" and \"all the major planned features have been added, so the interface should be pretty stable at this point.\""
    thread_status: {value: directly_linked, src: hn_thread}
    platforms: [linux, macos]
    agents_supported:
      value: [claude_code, codex, gemini_cli, grok, opencode]
      basis: Bundled agent skills ship for Claude Code, Codex, Gemini, Grok, and OpenCode.
    classification:
      role: runtime
      execution_locus: local
      isolation_boundary:
        value: container
        basis: "Local container via Docker or Podman (rootful or rootless), Debian-derived base images; current folder mounted read-write into /workspace. README: \"Not a security product: a container is not a microVM.\""
      state_model:
        value: persistent
        basis: Per-project state and cache volumes persist across rebuilds; agent logins persist per project, with an opt-in machine-wide shared-auth mode available at first run.
      network_policy:
        value: configurable
        basis: Open by default; the firewall skill flips to deny-by-default with an allowlist, and the firewall-open skill keeps network open while selectively blocking named hosts (egress = ["!host"]).
      credential_mediation: {value: mounted, basis: "Project mounted read-write; credentials passed through, with an opt-in shared-auth mode across projects."}
    risk:
      stated_scope:
        value: [t1_accidents]
        basis: "README explicitly says it is not a security product, that containers are not microVMs, and that protections exist \"from over-eager and reckless agents, not from state-sponsored malware\" — and are \"one config edit away from off.\""
      assessed_tiers:
        value: [t1_accidents]
        ev: editorial
        derived_from: [risk.stated_scope]
        basis: Matches the vendor's own honest scoping.
      design_intent:
        value: liberate
        ev: editorial
        basis: An ergonomic, comfortable box for agents, with transparency rather than gating as the differentiator.
    pricing: {model: free_oss}
    footprint_notes:
      value: Shared-kernel container per project; generated Dockerfiles keep lock-in low, with exit hatches (`byre dockerfile`, `byre dockerrun`) for leaving byre entirely.
      basis: Documented architecture.
    convenience_notes:
      - {value: "Interactive TUI config editor; TOML config layering (personal, template, shared, per-project); reusable templates (Go, Node, Python) and skills; `byre worktree` for linked git worktrees with separate boxed sessions; `byre deliver`/`byre grab` for bidirectional file transfer; MCP server support (`byre mcp add`); shippable `byre.preset` files."}
    integrations: [tui, toml_layering, generated_dockerfiles, templates, skills, mcp_server, worktrees, file_delivery, presets]
    audience: [individual_developer]
    limitations:
      - {value: Network open by default unless the firewall skill is enabled.}
      - {value: Project mounted read-write.}
      - {value: "Explicitly not an escape barrier, per its own README."}
      - {value: Debian-derived base images only.}
    compliance: {value: none_stated}

  - id: aide
    name: aide
    default_source: aide_repo
    tagline: One-command agent launcher with OS-native sandboxing, capability grants, and SOPS secrets.
    urls: {repo: "https://github.com/jskswamy/aide/"}
    license: MIT
    maturity: {value: early_active, basis: Actively released OSS with CI and sandbox docs; still evolving.}
    thread_status: {value: directly_linked, src: hn_thread}
    platforms: [macos, linux]
    agents_supported:
      value: [claude_code, codex, aider, agent_agnostic]
      basis: Unified launcher resolves whichever agent is configured or on PATH; Claude, Codex, and Aider cited in README examples.
    classification:
      role: runtime
      execution_locus: local
      isolation_boundary:
        value: os_sandbox
        basis: Platform-native enforcer — macOS Seatbelt or Linux Landlock (bubblewrap fallback for filesystem isolation when Landlock is unavailable).
      state_model: {value: persistent, basis: Host workspace and config; agent runs against the local project under sandbox rules rather than a disposable guest disk.}
      network_policy:
        value: open
        basis: Default code-only mode allows network outbound while locking sensitive host paths; no default-deny egress allowlist.
      credential_mediation:
        value: mounted
        basis: SOPS/age secrets decrypt in-process (not left as plaintext on disk); capability flags unlock specific host credential paths (AWS, docker, kubeconfig, etc.) into the sandbox.
    risk:
      stated_scope:
        value: [t1_accidents, t2_exfiltration]
        basis: README positions code-only guards against touching SSH keys, cloud credentials, and browser data while still allowing code work and network; not a hypervisor boundary.
      assessed_tiers:
        value: [t1_accidents, t2_exfiltration]
        ev: editorial
        derived_from: [classification.isolation_boundary, classification.credential_mediation]
        basis: OS sandbox plus capability-gated credentials address accidents and opportunistic exfiltration; hostile escape remains OS-sandbox-grade, not microVM/VM-grade.
      design_intent:
        value: both
        basis: Constrain via never-allow / capability walls; liberate via fewer permission prompts inside the approved envelope.
    pricing: {model: free_oss}
    footprint_notes:
      value: OS-sandbox primitives around the agent process; no VM or container required.
      basis: Documented Seatbelt / Landlock / bubblewrap path.
    convenience_notes:
      - {value: YAML project config with trust gate; one command across agents.}
      - {value: "Capability bundles (docker, k8s, aws, …) instead of hand-written path rules."}
    integrations: [cli, aide_yaml, sops_age_secrets, capabilities, mcp]
    audience: [individual_developer, team]
    limitations:
      - {value: "Shared-kernel OS sandbox, not a microVM or full VM."}
      - {value: Network open in default code-only mode.}
      - {value: Unlocked capabilities intentionally expose the corresponding credentials to the agent.}
    compliance: {value: none_stated}

  - id: nono
    name: nono
    default_source: nono_repo
    tagline: Kernel-enforced OS sandbox (Landlock/seccomp/Seatbelt) with a credential proxy for terminal coding agents.
    urls: {official: "https://nono.sh/", repo: "https://github.com/nolabs-ai/nono", docs: "https://nono.sh/docs/llms.txt"}
    license: Apache-2.0
    maturity:
      value: pre_1_0_active
      basis: v0.68.0 as of July 2026 with 100 GitHub releases (102 tags); README states "In the lead-up to a 1.0 release, APIs are stabilizing."
    thread_status:
      value: not_from_hn_thread
      src: user_email_2026_07_20
      basis: Added 2026-07-20 from a user-submitted recommendation (private email), independent of the source HN thread; the user described it as their current setup on top of a plain container dev env.
    platforms:
      value: [macos, linux, windows_wsl2]
      basis: Explicitly supports macOS, Linux (Debian/Ubuntu, Fedora, Arch, RHEL, openSUSE, Nix), and Windows via WSL2, with a documented WSL2 feature-compatibility matrix.
    agents_supported:
      value: [claude_code, opencode, codex, antigravity, goose, openclaw, copilot, qwen_code, pi, hermes]
      src: nono_site
      basis: Site states it "sandboxes any terminal agent" and names these explicitly.
    classification:
      role: runtime
      execution_locus: local
      isolation_boundary:
        value: os_sandbox
        basis: README states "no daemon, no container, no VM, and no disk space usage"; uses Linux Landlock layered with seccomp-notify, and Apple's Seatbelt sandbox on macOS.
      state_model:
        value: persistent
        basis: Runs directly against the host project (no separate VM/container disk); capability sets can be serialized/restored as JSON, and atomic rollbacks use content-addressable filesystem snapshots.
      network_policy:
        value: configurable
        basis: "Domain-level (L7) allow-list filtering and proxy modes; docs confirm the pre-configuration default is actually open — unrestricted network access — with default-deny/allow-listing only taking effect once `--allow-domain`/`--network-profile` is explicitly set."
      credential_mediation:
        value: host_side_injection
        src: nono_docs
        basis: "Site states secrets \"are injected at the boundary and never exposed to the agent\" and \"zeroised on exit\"; supports proxy-based injection (true host-side, opt-in via `--credential`) from OS keystore, 1Password, Bitwarden, Apple Passwords, files, or env, plus sandboxed OAuth logins where the agent only ever sees a phantom token. A second, less-safe mode (`--env-credential`) exposes the secret directly in the sandboxed process's environment instead — neither mode is the default; the user must opt into one."
    risk:
      stated_scope:
        value: [t1_accidents, t2_exfiltration]
        basis: Marketing centers on capability-based least privilege, irrevocable OS-level allow-lists, a credential proxy that keeps real secrets off the agent process, and a tamper-evident audit trail; it does not make an explicit hypervisor-grade escape claim.
      assessed_tiers:
        value: [t1_accidents, t2_exfiltration]
        ev: editorial
        derived_from: [classification.isolation_boundary, classification.network_policy, classification.credential_mediation]
        basis: Landlock/seccomp/Seatbelt is OS-sandbox-grade, not microVM/VM-grade, so it is assessed like this dataset's other os_sandbox entries (aide, flar) — credible for accidents and exfiltration, not for hostile-code escape.
      design_intent:
        value: constrain
        basis: Framing centers on capability-based least privilege, irrevocable allow-lists, and audit trails — gating agent actions rather than open-ended autonomy.
    pricing:
      model: free_oss
      notes: {value: "Core CLI is Apache-2.0 OSS; a dedicated pricing page returned 404 at audit time (2026-07-20), so a possible paid/hosted tier is unconfirmed."}
    footprint_notes:
      value: No daemon, container, or VM disk usage — kernel primitives applied directly to the agent process.
      basis: README's own framing ("no daemon, no container, no VM, and no disk space usage").
    convenience_notes:
      - {value: OAuth logins run inside the sandbox using phantom tokens; capability sets are serializable to JSON for reuse across sessions.}
    integrations: [cli, credential_proxy, oauth_phantom_tokens, capability_sets_json, os_keystore_integrations]
    audience: [individual_developer, security_minded_developer]
    limitations:
      - {value: "Pre-1.0; APIs still stabilizing, per its own docs."}
      - {value: "OS-sandbox boundary (Landlock/seccomp/Seatbelt), not hypervisor-grade."}
      - {value: Windows support is WSL2-only with documented feature gaps.}
    compliance: {value: none_stated}

  - id: leash
    name: Leash (strongDM)
    default_source: leash_repo
    tagline: Cedar-policy-enforced container wrapper for coding agents, with filesystem/network/MCP-call monitoring.
    urls: {repo: "https://github.com/strongdm/leash"}
    license: Apache-2.0
    maturity: {value: early_active, basis: "9 releases, latest v1.1.7 as of March 2026; 581 GitHub stars; active development."}
    thread_status:
      value: not_from_hn_thread
      src: user_email_2026_07_20
      basis: Added 2026-07-20 from a user-submitted recommendation (private email); the user reported starting here before nono.sh but moving off it because spinning it up per git worktree was too slow for their workflow.
    platforms:
      value: [macos, linux, windows_wsl2]
      basis: "README states support for \"macOS or Linux (WSL, too!)\"; ships a native macOS helper app for an experimental monitoring mode."
    agents_supported:
      value: [claude_code, codex, gemini_cli, qwen_code, opencode]
      basis: Built-in agent images ship for claude, codex, gemini, qwen, and opencode via the default coder image; extensible to custom images.
    classification:
      role: policy_wrapper
      execution_locus: local
      isolation_boundary: {value: container, basis: Wraps agents in Docker/Podman containers with syscall-level activity monitoring.}
      state_model: unspecified
      network_policy:
        value: configurable
        basis: "Cedar policy files can restrict which network connections the containerized agent may initiate, and full monitoring mode logs every connection made — but a policy is opt-in (`--policy` is an optional flag); primary sources do not document a deny-by-default network posture with no policy supplied."
      credential_mediation:
        value: mounted
        basis: "Environment forwarding automatically maps provider API keys (ANTHROPIC_API_KEY, OPENAI_API_KEY, GEMINI_API_KEY, DASHSCOPE_API_KEY) into the container; mount prompts let users approve credential forwarding with persistent decisions, and agent config directories such as ~/.codex can be bind-mounted read-write into the container per docs/CONFIG.md — keys and configs land inside the container rather than being proxied at the boundary."
    risk:
      stated_scope:
        value: [t1_accidents]
        basis: README frames Leash as wrapping agents in containers and monitoring every filesystem access and network connection, with Cedar policy enforcement and MCP tool-call inspection; it documents monitoring and optional policy enforcement, not a default-deny egress posture, so it does not itself claim exfiltration-tier containment out of the box.
      assessed_tiers:
        value: [t1_accidents]
        ev: editorial
        derived_from: [classification.isolation_boundary, classification.network_policy, classification.credential_mediation]
        basis: Container boundary supports accident containment. Exfiltration-tier credit requires a restrictive network policy to be in effect, but network policy here is opt-in rather than default-deny, and provider credentials plus agent config directories can be mounted read-write into the container — so t2_exfiltration is not assessed without the operator configuring a Cedar policy themselves. Hostile-code escape is out of scope without a hypervisor/microVM boundary.
      design_intent:
        value: constrain
        basis: Cedar policy rules gate filesystem, network, and MCP tool calls while the agent runs.
    pricing: {model: free_oss}
    footprint_notes:
      value: Two containers per session (an agent container plus a Leash manager container) via Docker/Podman; native macOS helper app adds an experimental monitoring mode.
      basis: "README's Key Concepts section documents an agent container plus a manager container, with env vars forwarded into both."
    convenience_notes:
      - {value: "Default coder image ships ready-to-run agent CLIs (claude, codex, gemini, qwen, opencode); install via npm, Homebrew (macOS), or prebuilt binaries."}
    integrations: [cli, npm, homebrew, cedar_policies, mcp_inspection, docker, podman]
    audience: [individual_developer]
    limitations:
      - {value: "Its own DISCLAIMER.txt provides no warranty and states \"no support or maintenance is provided. Use is at your own risk,\" with no further security scoping.", src: leash_disclaimer}
      - {value: Provider API keys are forwarded into the container rather than proxied at the boundary.}
      - {value: One user reported per-worktree spin-up was slow enough to prompt switching to a different tool; not vendor-documented or independently benchmarked., ev: editorial, src: user_email_2026_07_20}
    compliance: {value: none_stated}

  - id: greywall
    name: Greywall
    default_source: greywall_repo
    tagline: Container-free, deny-by-default OS sandbox with kernel-level transparent network capture and host-side credential substitution.
    urls: {official: "https://greywall.io/", repo: "https://github.com/GreyhavenHQ/greywall", docs: "https://docs.greywall.io/greywall"}
    license: Apache-2.0
    maturity:
      value: pre_1_0_active
      src: greywall_github_api
      basis: "v0.3.7 as of 2026-06-01 (verified via GitHub API, not just marketing copy); 271 GitHub stars; repo created 2026-03-04, last pushed 2026-06-11 -- roughly six weeks stale relative to this audit."
    thread_status:
      value: not_from_hn_thread
      src: user_email_2026_07_20
      basis: Added 2026-07-20 from a user-submitted recommendation, independent of the source HN thread.
    platforms:
      value: [linux, macos]
      basis: "Linux gets the full five-layer stack (bubblewrap, Landlock, seccomp-BPF, eBPF monitoring, TUN-based transparent network capture); macOS uses sandbox-exec (Seatbelt) with no transparent network capture -- network mediation there falls back to proxy-env-var cooperation only, a materially weaker exfiltration boundary than Linux's."
    agents_supported:
      value: [claude_code, codex, cursor, aider, goose, gemini_cli, opencode, copilot, pi]
      src: greywall_agent_profiles_tree
      basis: "Repo's internal/profiles/agents tree ships 14 built-in profiles: these 9 plus Amp, Cline, Kilo, Auggie, and Droid, none of which have ids in this dataset's closed agents_supported taxonomy; recorded here rather than expanding the taxonomy per-agent."
    classification:
      role: runtime
      execution_locus: local
      isolation_boundary:
        value: os_sandbox
        basis: "Bubblewrap namespacing + Landlock + seccomp-BPF + eBPF violation monitoring on Linux, Seatbelt on macOS -- all OS-primitive boundaries, not a container/VM backend, so classified like nono rather than as `layered`."
      state_model:
        value: persistent
        basis: Runs directly against the host project via OS primitives; no separate container/VM disk to reset.
      network_policy:
        value: proxy_mediated
        basis: "Default-deny; all traffic routed through greyproxy (SOCKS5, local dashboard). On Linux this is enforced via kernel-level TUN capture so it also catches binaries that ignore proxy env vars -- the explicit reason Greyhaven built this instead of adopting Fence (see limitations). `--watch` mode inverts to allow-by-default for observability while keeping proxy visibility."
      credential_mediation:
        value: host_side_injection
        src: greywall_credentials
        basis: "Credential substitution is on by default: env vars matching known secret patterns are replaced with an opaque placeholder token in the sandboxed process; greyproxy substitutes the real value only at egress, so the agent process never holds the real key. `.env` handling differs by platform: on Linux a rewritten placeholder copy is bind-mounted read-only over the original (readable, but fake, without breaking tools that expect the file to exist); on macOS Seatbelt can't redirect a read to a different file, so `.env` is denied outright instead. SSH keys and git hooks are denied on both. Disableable via --no-credential-protection."
    risk:
      stated_scope:
        value: [t1_accidents, t2_exfiltration]
        basis: "Marketing and docs center on accidental destructive commands, credential exposure via .env/secrets, and network exfiltration (blocking egress to arbitrary domains, including from binaries that bypass proxy env vars); five kernel-enforced layers are also framed as blocking dangerous syscalls, but no hypervisor-grade escape claim is made."
      assessed_tiers:
        value: [t1_accidents, t2_exfiltration]
        ev: editorial
        derived_from: [classification.isolation_boundary, classification.network_policy, classification.credential_mediation]
        basis: "OS-sandbox boundary (bubblewrap/Landlock/seccomp/Seatbelt) is assessed like this dataset's other os_sandbox entries (nono, aide, flar) -- credible for accidents and exfiltration given the proxy-mediated network default and host-side credential injection, not for hostile-code escape without a hypervisor/microVM boundary. On macOS specifically, the weaker (env-var-only) network mediation makes the exfiltration assessment less confident than on Linux."
      design_intent:
        value: constrain
        basis: Framing centers on deny-by-default gating of filesystem, network, and syscall access, plus live observability of what the agent touches.
    pricing:
      model: free_oss
      notes: {value: "Core tool is Apache-2.0 OSS; site mentions a team-wide \"managed governance layer\" as coming soon, no pricing published."}
    footprint_notes:
      value: Container-free -- OS primitives (bubblewrap/Landlock/seccomp/Seatbelt) applied directly to the wrapped process, no image builds or container/VM disk.
      basis: "Built explicitly to avoid the image-rebuild friction of Greyhaven's earlier Docker-based tool (Cubbi), per their own origin writeup."
    convenience_notes:
      - {value: "Learning mode traces filesystem access (strace on Linux, eslogger on macOS) while running a command permissively, then auto-generates a least-privilege profile; ships built-in profiles for common toolchains (Node, Python, Go, Rust, Java, Ruby, Docker) layerable via --profile."}
    integrations: [cli, homebrew, go_install, mise, socks5_proxy, dashboard]
    audience: [individual_developer, security_minded_developer]
    limitations:
      - {value: "Pre-1.0; repo last pushed 2026-06-11, about six weeks stale relative to this audit.", src: greywall_github_api}
      - {value: "OS-sandbox boundary (bubblewrap/Landlock/seccomp/Seatbelt), not hypervisor-grade."}
      - {value: "macOS lacks Linux's kernel-level TUN network capture -- network mediation there depends on the process cooperating with proxy env vars. Greyhaven's own origin post cites exactly this class of gap (proxy-cooperation dependence) in Fence, a prior project they evaluated, as their stated reason for building Greywall instead; per the separate fence entry, Fence's current default policy is actually kernel-enforced on both platforms except in specific fallback/relaxed configurations, so treat this as Greyhaven's historical framing rather than a live comparison of the two tools' current behavior.", src: greyhaven_origin_post}
      - {value: "14 built-in agent profiles, but 5 (Amp, Cline, Kilo, Auggie, Droid) have no id in this dataset's closed agents_supported taxonomy and aren't represented in that field.", ev: editorial, basis: "Counted directly from the repo's internal/profiles/agents directory listing (14 files) against this dataset's closed taxonomy.agents_supported list; the gap is this dataset's classification limitation, not something Greywall's own docs state."}
    compliance: {value: none_stated}

  - id: fence
    name: Fence
    default_source: fence_repo
    tagline: Lightweight, container-free OS sandbox with per-agent config templates; the project Greywall's authors evaluated and moved away from.
    urls: {official: "https://fencesandbox.com/", repo: "https://github.com/fencesandbox/fence", docs: "https://github.com/fencesandbox/fence/blob/main/docs/README.md"}
    license: Apache-2.0
    maturity:
      value: pre_1_0_active
      src: fence_github_api
      basis: "v0.1.63 as of 2026-07-19 (verified via GitHub API); 859 GitHub stars; 64 releases; repo created 2025-12-18 and pushed as recently as the day before this audit -- markedly more active than Greywall's six-week-stale push. Moved orgs from github.com/Use-Tusk/fence to github.com/fencesandbox/fence; the old org's API path 301-redirects to the same repository via GitHub's repo-id endpoint, i.e. a tracked rename, not a dead/abandoned repo."
    thread_status:
      value: not_from_hn_thread
      src: agent_research_2026_07_20
      basis: "Investigated 2026-07-20 after Greywall's own origin post (see the greywall entry's limitations) named Fence as a prior project Greyhaven evaluated before building their own tool; not part of this dataset's primary Clawk HN thread."
    platforms:
      value: [macos, linux, windows_wsl2]
      basis: "macOS via sandbox-exec (Seatbelt); Linux via bubblewrap+seccomp+Landlock; Windows only via the Nix install method running under WSL, per its own install docs -- no native Windows support documented."
    agents_supported:
      value: [claude_code, codex, gemini_cli, copilot, cursor, opencode, pi]
      src: fence_agents_docs
      basis: "docs/agents.md documents template support for these plus Amp, Droid, and Crush, none of which have ids in this dataset's closed agents_supported taxonomy (same gap noted on the greywall entry); Cursor needs the code-relaxed template specifically because its Node/undici HTTP client doesn't respect HTTP_PROXY."
    classification:
      role: runtime
      execution_locus: local
      isolation_boundary:
        value: os_sandbox
        basis: "sandbox-exec on macOS, bubblewrap+seccomp+Landlock on Linux -- OS-primitive boundaries, no container/VM backend, classified like nono/greywall rather than as `layered`."
      state_model:
        value: persistent
        basis: Runs directly against the host project via OS primitives; no separate container/VM disk to reset.
      network_policy:
        value: proxy_mediated
        basis: "Domain allowlisting enforced via Fence's own HTTP/SOCKS5 proxies, block-all-by-default, and the default posture is kernel-enforced on both platforms per ARCHITECTURE.md: Linux with network-namespace support has no direct route to the network at all (raw sockets can't reach anything except the proxy bridge), and macOS's default 'proxy-only' Seatbelt profile likewise denies direct outbound connections at the sandbox-policy level, not merely by convention. Enforcement drops to cooperation-with-proxy-env-vars in documented fallback/opt-in cases: Linux environments without network-namespace support (some containers/CI), and the relaxed template (`allowedDomains: [\"*\"]`, the one documented for Cursor) on either platform -- on Linux it also disables `--unshare-net`, not just macOS's Seatbelt restriction. Its own why-fence.md calls domain-based allowlisting 'crude' regardless of enforcement path -- an allowed domain can still be used to exfiltrate data, since there's no content inspection."
      credential_mediation:
        value: ambient
        src: fence_configuration_docs
        basis: "No credential substitution/injection mechanism is documented (unlike nono/greywall's host-side proxy injection) -- any secret already in the process environment (e.g. a provider API key) stays ambient and visible to the sandboxed agent. The default 'code' template does deny filesystem reads to .env and ~/.ssh by default, and blocks cloud metadata-service IPs, but that's a filesystem/network floor, not mediation of credentials the agent legitimately needs."
    risk:
      stated_scope:
        value: [t1_accidents, t2_exfiltration]
        basis: "Its own why-fence.md frames the tool around default-deny network egress (for exfiltration/supply-chain risk) and filesystem write restrictions (for accidents), while explicitly disclaiming several other threat classes (see limitations) -- an unusually candid non-goals section for this dataset."
      assessed_tiers:
        value: [t1_accidents]
        ev: editorial
        derived_from: [classification.isolation_boundary, classification.network_policy, classification.credential_mediation]
        basis: "OS-sandbox boundary supports accident containment reliably, and the default network policy is kernel-enforced on both platforms (see classification.network_policy). Exfiltration-tier credit is nonetheless withheld here (unlike nono/greywall): credentials are ambient rather than mediated, so an already-ambient secret can leave through any allowed domain, which the project's own docs concede is a crude, non-content-inspecting control -- and enforcement itself falls back to cooperation-dependent in specific documented cases (no Linux network-namespace support; the relaxed template on either platform, which also disables Linux's --unshare-net). Hostile-code escape is explicitly out of scope per its own non-goals."
      design_intent:
        value: constrain
        basis: Framing centers on default-deny network/filesystem policy the operator configures and commits, gating agent actions.
    pricing:
      model: free_oss
      notes: {value: "Apache-2.0 CLI tool; no pricing page or commercial tier found (unlike Greywall, which has a company, Greyhaven, behind it with a 'coming soon' governance layer)."}
    footprint_notes:
      value: Container-free -- OS primitives (sandbox-exec/bubblewrap) applied directly to the wrapped process, no image builds or container/VM disk.
      basis: README frames it as a lightweight alternative to containerizing every sandboxed command.
    convenience_notes:
      - {value: "Config uses inheritance-based templates (e.g. \"extends\": \"code\") for per-agent rulesets; a monitoring mode observes actual filesystem/network needs before locking down a policy; Claude Code, Cursor, and OpenCode support hook-based rewriting of shell commands to run through fence -c automatically."}
    integrations: [cli, homebrew, nix, go_install, http_proxy, socks5_proxy]
    audience: [individual_developer, security_minded_developer]
    limitations:
      - {value: "Own docs (why-fence.md) explicitly disclaim protection against actively malicious code, resource exhaustion (no CPU/RAM/disk limits), timing attacks, and kernel escapes.", src: fence_why}
      - {value: "Domain-based network allowlisting is content-blind -- its own docs call this 'crude', since an allowed domain can still be used to exfiltrate data.", src: fence_why}
      - {value: "No credential substitution/redaction mechanism; secrets already in the process environment remain ambient to the sandboxed agent."}
      - {value: "Default network enforcement is kernel-enforced on both platforms (Linux network namespaces; macOS proxy-only Seatbelt profile), but degrades to cooperation-with-proxy-env-vars: on Linux without network-namespace support (some containers/CI), and under the relaxed template on either platform -- on Linux the relaxed template also disables --unshare-net, not just macOS's Seatbelt restriction.", src: fence_architecture}
      - {value: "7 built-in agent templates map to this dataset's taxonomy; Amp, Droid, and Crush don't have ids and aren't represented in that field.", ev: editorial, basis: "Counted directly from docs/agents.md's documented template list against this dataset's closed taxonomy.agents_supported list; the gap is this dataset's classification limitation, not something Fence's own docs state."}
    compliance: {value: none_stated}

  - id: omnigent
    name: Omnigent (Omnibox sandbox)
    default_source: omnigent_repo
    tagline: Databricks' open-source meta-harness for orchestrating coding-agent CLIs, with a bundled OS-sandbox feature (Omnibox) for filesystem/network isolation and credential injection.
    urls: {official: "https://omnigent.ai/", repo: "https://github.com/omnigent-ai/omnigent", docs: "https://omnigent.ai/docs/omnibox", blog: "https://www.databricks.com/blog/introducing-omnigent-meta-harness-combine-control-and-share-your-agents"}
    license: Apache-2.0
    maturity:
      value: pre_1_0_active
      src: omnigent_github_api
      basis: "v0.5.1 as of 2026-07-10 (verified via GitHub API); 7,545 GitHub stars; repo created 2026-06-11 and pushed as recently as today (2026-07-20) -- about six weeks old but growing fast, with Databricks (incl. Matei Zaharia) publicly behind it."
    thread_status:
      value: not_from_hn_thread
      src: user_submitted_links_2026_07_20
      basis: "User pasted the Databricks announcement blog and Omnibox docs URLs directly in-session, 2026-07-20; not part of this dataset's primary Clawk HN thread."
    platforms:
      value: [linux, macos, windows_powershell]
      basis: "Full filesystem+network isolation via bubblewrap+seccomp (Linux) and Seatbelt (macOS), both kernel-enforced. Windows uses a Job Object backend that is NOT equivalent: filesystem and network restrictions from the same spec fields are explicitly advisory and unenforced there (one-time warning emitted, no actual isolation). Its docstring/README also claim optional CPU/memory ceilings, but the implementation (windows_jobobject_sandbox.py's post_spawn) discards the resolved policy (`del policy`) and only ever sets JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE -- so shipped Windows behavior is process-tree kill-on-close only, weaker even than its own docs claim."
    agents_supported:
      value: [claude_code, codex, cursor, opencode, pi, goose, qwen_code, antigravity, hermes, kimi_code, copilot]
      src: omnigent_repo
      basis: "The docs page names only Claude Code, Codex, and \"custom agents\" explicitly, but the repo's own native-integration modules (claude_native*.py, codex_native*.py, cursor_native*.py, opencode_native*.py, pi_native*.py, goose_native*.py, qwen_native*.py, antigravity_native*.py, hermes_native*.py, kimi_native*.py) show real native support for ten, and harness_plugins.py registers an eleventh, SDK-based (not native-terminal) copilot harness (omnigent.inner.copilot_harness). A further kiro_native*.py integration exists with no id in this dataset's closed agents_supported taxonomy."
    classification:
      role: runtime_feature
      execution_locus: local
      isolation_boundary:
        value: os_sandbox
        basis: "Bubblewrap+seccomp (Linux) / Seatbelt (macOS) give a real kernel-enforced boundary; the platform-default backend is chosen at spec-parse time and fails loudly (raises, explicitly 'no silent fallback') if the required binary is missing, rather than silently downgrading. Windows's Job Object backend is a materially weaker boundary -- see platforms basis -- so this os_sandbox rating describes the Linux/macOS backends specifically."
      state_model:
        value: persistent
        basis: Runs directly against the host project via OS primitives; no separate container/VM disk to reset.
      network_policy:
        value: configurable
        basis: "On Linux/macOS, a default-deny egress proxy enforces an explicit allow-list of hosts/paths/methods and blocks private IPs and cloud metadata endpoints by default, backed by real kernel-level network isolation. On Windows, the identical spec fields (e.g. allow_network) are accepted but not enforced by the Job Object backend, which does no network isolation at all -- so unlike nono/greywall's more uniform proxy_mediated posture, this is genuinely per-platform rather than one consistent default."
      credential_mediation:
        value: host_side_injection
        src: omnigent_docs_omnibox
        basis: "Blog and docs describe placeholder tokens issued to the agent process, with the real credential swapped in only at the egress proxy for requests matching the allow-list, so the agent process itself never holds the real secret -- architecturally close to nono/greywall's model. That guarantee rides on the same platform split as network_policy: credible on Linux/macOS, where network really is confined to the mediated proxy path; unconfirmed on Windows, where nothing in the sandbox itself forces traffic through the proxy to begin with."
    risk:
      stated_scope:
        value: [t1_accidents, t2_exfiltration]
        basis: "Blog's own framing example is explicit: 'don't let an agent ever see your GitHub security token, but instead, inject it only in the egress proxy on approved requests' -- a direct accidents/exfiltration framing, paired with default-deny network and denied access to private IPs/cloud metadata."
      assessed_tiers:
        value: [t1_accidents, t2_exfiltration]
        ev: editorial
        derived_from: [classification.isolation_boundary, classification.network_policy, classification.credential_mediation]
        basis: "Credible on Linux/macOS, where the OS-sandbox boundary genuinely confines egress to the mediated proxy path and credentials never reach the agent process directly -- assessed like this dataset's other os_sandbox entries with host-side credential injection (nono, greywall). This assessment describes the Linux/macOS backends only: on Windows, filesystem and network restrictions are explicitly advisory and unenforced, so neither tier should be assumed to hold there. No hypervisor-grade boundary exists on any platform, so hostile-code escape is out of scope everywhere."
      design_intent:
        value: constrain
        basis: Framing centers on locking down OS/network access by default and injecting credentials only on approved egress requests -- gating rather than open-ended autonomy.
    pricing:
      model: free_oss
      notes: {value: "Apache-2.0, no separate Omnibox pricing. The repo's own sandbox-launcher CLI code references a Databricks-hosted remote sandbox provider ('Lakebox') as internal-only ('ships only internally'), so the externally available OSS repo's remote-hosting story is incomplete for outside users."}
    footprint_notes:
      value: OS-sandbox primitives on Linux/macOS (no container/VM); Windows relies on a Job Object that only kills the process tree together on close -- resource ceilings the docstring describes as available aren't actually wired up in the shipped code.
      basis: "Linux/macOS claim per the bwrap/Seatbelt backend module docstrings. The Windows correction is grounded in the implementation itself, not its docs: windows_jobobject_sandbox.py's post_spawn discards the resolved policy (`del policy`) and only ever sets JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE -- the module's own docstring and the project README both describe CPU/memory ceilings as available, which the shipped code does not implement."
    convenience_notes:
      - {value: "Bundled into a meta-harness that already integrates 11 agent CLIs/SDKs (see agents_supported) under one config, rather than requiring a separate sandbox wrapper per agent; also adds real-time session sharing/collaboration on top, per the Databricks announcement."}
    integrations: [cli, egress_proxy, policies, harness_plugins]
    audience: [individual_developer, team]
    limitations:
      - {value: "Not a standalone tool -- Omnibox has no separate package or binary; it only runs as an internal component of the full Omnigent harness.", ev: editorial, basis: "Inferred from the repo tree: sandbox logic lives in omnigent/inner/bwrap_sandbox.py, seatbelt_sandbox.py, and windows_jobobject_sandbox.py as internal modules of the omnigent package, with no separate omnibox repo, PyPI package, or binary found."}
      - {value: "Windows sandboxing is materially weaker than Linux/macOS: filesystem and network restrictions are explicitly advisory and unenforced on the Job Object backend, and even the CPU/memory ceilings its own docstring/README describe aren't actually implemented -- post_spawn discards the resolved policy and only ever sets kill-on-close. Shipped Windows behavior is process-tree kill-on-close, nothing more.", src: omnigent_repo}
      - {value: "Pre-1.0 and about six weeks old as of this audit (repo created 2026-06-11), despite fast growth (7,545 stars) and Databricks backing.", src: omnigent_github_api}
      - {value: "The docs page names only Claude Code, Codex, and \"custom agents\" explicitly; the fuller list recorded here (ten native-terminal integrations plus one SDK-based harness, Copilot) is inferred from the repo's own integration modules and harness registry, not itself a documented supported-agents list.", ev: editorial, basis: "Cross-checked omnigent.ai/docs/omnibox's stated agent list against the repo's *_native*.py modules and harness_plugins.py's registered harnesses -- the docs page undersells what the source actually ships."}
      - {value: "A Databricks-hosted remote sandbox launcher ('Lakebox') is referenced in the repo's own CLI code as internal-only, so it isn't available to external users of the OSS repo.", src: omnigent_repo}
    compliance: {value: none_stated}

  - id: discobox
    name: Discobox
    default_source: discobox_repo
    tagline: Disposable per-task boxes with their own git clone, services, desktop, and browser.
    urls: {official: "https://discobox.ai/", repo: "https://github.com/discobox-ai/discobox"}
    license: Apache-2.0
    maturity: {value: pre_1_0_active, basis: v0.12.0 as of October 2026; README says it is under active development.}
    thread_status:
      value: not_from_hn_thread
      src: inclusion_request_2026_10_01
      basis: Added 2026-10-01 from an inclusion request sent to the dataset maintainer.
    platforms:
      value: [macos, linux, windows_wsl2]
      basis: README lists macOS, Linux, and Windows; macOS is Apple Silicon only, and the Windows client (installed via PowerShell) runs its pools on WSL Containers.
    agents_supported: [claude_code, codex, opencode, agent_agnostic]
    classification:
      role: runtime
      execution_locus: local
      isolation_boundary: {value: container, basis: "Privileged container per box; on macOS and Windows these run inside one VM per pool, on Linux directly on host Docker (libkrun microVM opt-in)."}
      state_model: {value: copy_apply, basis: Each box clones the repo; `discobox apply` cherry-picks its commits back onto your branch.}
      network_policy: {value: open, src: discobox_proxy, basis: "Egress passes through an auditing proxy; it has an allowlist, but no product setting enables it yet."}
      credential_mediation: {value: host_side_injection, basis: Agent sees placeholder sentinels; the proxy swaps in the real credential only for its bound domain.}
    risk:
      stated_scope:
        value: [t1_accidents, t2_exfiltration]
        basis: README centers on VM/container isolation, an auditing egress proxy, and credentials kept outside the box.
      assessed_tiers:
        value: [t1_accidents]
        ev: editorial
        derived_from: [classification.isolation_boundary, classification.network_policy, classification.credential_mediation]
        basis: Credentials stay out of the box, but open egress means t2 is not assessed (as with fly_sprites); privileged containers and no VM on Linux rule out t3.
      design_intent: {value: liberate, basis: "Passwordless sudo, nested Docker, and no approval prompts inside the box."}
    pricing: {model: free_oss}
    footprint_notes:
      value: One VM per pool on macOS/Windows; one container per box with its own services, Docker, and desktop.
      basis: Documented deployment unit per platform.
    convenience_notes:
      - {value: "Parallel boxes against one repo without touching your checkout; connect via terminal, SSH, VS Code/Zed, or noVNC desktop."}
    integrations: [cli, openapi_api, homebrew, ssh, novnc_desktop, credential_proxy, llm_judge, git_cherry_pick_apply]
    audience: [individual_developer, small_team]
    limitations:
      - {value: Linux default has no VM; rootless/user-namespace isolation is still a proposed ADR., src: discobox_adr_userns}
      - {value: Boxes in a pool share one VM (macOS/Windows) or the host Docker daemon (Linux); macOS and Linux pools get read-only access to home directories for cloning., src: discobox_vz}
      - {value: No Intel Mac build., src: discobox_installer}
    compliance: {value: none_stated}

  - id: docker_sandboxes
    name: Docker Sandboxes (sbx)
    default_source: docker_sandboxes_docs
    tagline: Isolated microVM sandboxes with a private Docker daemon, host-side credential injection, and preset-based egress policy.
    urls: {official: "https://docs.docker.com/ai/sandboxes/", docs: "https://docs.docker.com/ai/sandboxes/", releases: "https://github.com/docker/sbx-releases"}
    license: proprietary
    maturity: {value: pre_1_0_active, src: docker_sandboxes_release_notes, basis: "Stable pre-1.0 releases (v0.45.1 in the docs release notes, 2026-09-22); the local product carries no beta label, but cloud sandboxes and the Sandboxes API are marked experimental."}
    thread_status: {value: not_from_hn_thread, src: contributor_submission_2026_08_28, basis: "Added from an outside contributor's submission (PR #2), independent of the source HN thread."}
    platforms: {value: [macos, linux, windows_powershell, cloud], src: docker_sandboxes_install, basis: "Native installs: macOS 14+ on Apple Silicon; Windows 11 x64 with Windows Hypervisor Platform (no WSL needed); Ubuntu 24.04+ with KVM (derivatives unsupported). Cloud sandboxes via sbx --cloud."}
    agents_supported:
      value: [claude_code, codex, copilot, cursor, gemini_cli, opencode]
      src: docker_sandboxes_agents
      basis: "Docs list Claude Code, Codex, Copilot, Cursor, Devin, Docker Agent, Droid, Gemini, Kiro, OpenCode, and Shell. Devin, Docker Agent, Droid, Kiro, and Shell have no ids in this dataset's closed agents_supported taxonomy; recorded here rather than expanding the taxonomy per-agent."
    classification:
      role: runtime
      execution_locus: {value: hybrid, basis: "Local microVMs by default; sbx --cloud runs sandboxes on Docker-managed infrastructure (experimental)."}
      isolation_boundary: {value: microvm, src: docker_sandboxes_architecture, basis: "Each sandbox is a separate hypervisor-backed microVM with its own kernel, Docker Engine, and filesystem. Hypervisor isolation is the primary trust boundary."}
      state_model: {value: configurable, src: docker_sandboxes_architecture, basis: "Local sandboxes persist until explicitly removed (sbx rm); VM state, Docker images, installed packages, and agent history carry over between runs. Cloud sandboxes expire after one hour by default."}
      network_policy: {value: configurable, src: docker_sandboxes_local_policy, basis: "Outbound TCP goes through a host-side policy proxy. On first run the CLI asks for a preset: Open (allow all), Balanced (default deny plus a baseline allowlist with broad wildcards; pre-selected), or Locked Down. UDP and ICMP are blocked by default."}
      credential_mediation: {value: host_side_injection, src: docker_sandboxes_security, basis: "Host-side proxy injects authentication headers into outbound HTTP requests; raw credential values never enter the VM. Credentials provided via sbx secret or environment variables."}
    risk:
      stated_scope:
        value: [t1_accidents, t2_exfiltration, t3_hostile_escape]
        src: docker_sandboxes_security
        basis: "Security model explicitly covers hypervisor isolation (hostile escape), a policy-enforcing network proxy (exfiltration), and credential injection (exfiltration). Workspace isolation is opt-in via --clone mode."
      assessed_tiers:
        value: [t1_accidents, t2_exfiltration, t3_hostile_escape]
        ev: editorial
        derived_from: [classification.isolation_boundary, classification.network_policy, classification.credential_mediation]
        basis: "MicroVM boundary is hypervisor-grade (credible for hostile escape). Credential injection plus a default-deny preset addresses exfiltration, though choosing the Open preset weakens t2. t1 covers the host outside the workspace: the current directory is mounted read-write by default, with --clone opt-in."
      design_intent:
        value: liberate
        ev: editorial
        basis: "Built to let agents run autonomously with full Docker access inside a strong boundary, not to gate every tool call."
    pricing:
      model: free_tier_plus_usage
      notes: {value: "sbx CLI and local sandbox compute are free, including for commercial use. Cloud sandboxes bill pay-as-you-go compute; organization governance (central network/filesystem/MCP policies) is a separate paid subscription.", src: docker_sandboxes_faq}
    footprint_notes:
      value: "One microVM per sandbox with its own Docker daemon; disk grows with images, containers, and packages. Virtiofs caching enabled by default on all OSes."
      basis: "Documented architecture; each sandbox maintains isolated Docker daemon state and image cache."
    convenience_notes:
      - {value: "sbx run <agent> one-command launch; SSH/VS Code integration; MCP gateway; shared agent skills store; reusable templates (kits); clone mode for workspace isolation."}
    integrations: [cli, ssh, vscode, mcp_gateway, agent_skills, kits, upstream_proxy, governance]
    audience: [individual_developer, team, enterprise]
    limitations:
      - {value: "Direct workspace mount is read-write by default — agent edits host files live; clone mode (--clone) is opt-in.", src: docker_sandboxes_security}
      - {value: "Default allowed domains include broad wildcards (e.g., *.googleapis.com); operator must prune with sbx policy.", src: docker_sandboxes_defaults}
      - {value: "Shared agent skills store (experimental) mounts read-only by default; a sandbox given --skills=readwrite can change skills other sandboxes load. Opt out with --skills=off.", src: docker_sandboxes_defaults}
      - {value: "Local stdio MCP servers run on host, not in sandbox; if they spawn containers, those use host Docker/permissions.", src: docker_sandboxes_security}
      - {value: "macOS requires Apple Silicon (M1+); Intel Macs unsupported. Linux requires KVM + nested virt if in VM. Windows requires Hypervisor Platform.", src: docker_sandboxes_install}
      - {value: "Sign-in to Docker required (OAuth).", src: docker_sandboxes_install}
    compliance: {value: none_stated_in_fetched_docs}

# -----------------------------------------------------------------------------
# Adjacent tools & approaches. Same claim conventions; lighter schema.
# -----------------------------------------------------------------------------
adjacent:

  - id: paseo
    name: Paseo
    role: orchestrator
    default_source: paseo_docs
    urls: {official: "https://paseo.sh/", docs: "https://paseo.sh/docs/providers"}
    thread_status: {value: directly_linked, src: hn_thread}
    summary:
      value: Local-first orchestrator for multiple coding-agent CLIs; self-hostable.
      basis: Its own docs say it doesn't ship a coding agent — it launches and supervises existing CLIs. Not itself the trust boundary.
    pairs_with: [clawk, yoloai, virtdev, exe_dev]

  - id: skynot
    name: skynot
    role: pattern
    default_source: skynot_repo
    urls: {repo: "https://github.com/tarsgate/skynot"}
    thread_status: {value: directly_linked, src: hn_thread}
    summary:
      value: Dedicated-user install pattern — creates an aidev user with shared ACLs, installs Pi in that user's home, launches the agent only in a restricted work tree.
      basis: Documented mechanism in the repo.
    risk:
      assessed_tiers:
        value: [t1_accidents]
        ev: editorial
        basis: Kernel and installed programs remain shared; thread commenters disputed user separation on exactly these grounds.

  - id: take_ai_control
    name: take-ai-control
    role: template
    default_source: takeaicontrol_repo
    urls: {repo: "https://github.com/daitangio/take-ai-control"}
    thread_status: {value: directly_linked, src: hn_thread}
    summary:
      value: Template repo packaging Pi inside a devcontainer with a non-root user and explicit environment files.
      basis: Repo documentation.

  - id: scratch
    name: scratch
    role: orchestrator
    default_source: scratch_repo
    urls: {repo: "https://github.com/housecat-inc/scratch"}
    thread_status: {value: directly_linked, src: hn_thread}
    summary:
      value: Agent toolkit one commenter places inside sandboxes; adjacent tooling, not a boundary.
      ev: thread
      src: hn_thread

  - id: katsuobushi_sandbox
    name: katsuobushi sandbox
    role: template
    default_source: katsuobushi_repo
    urls: {repo: "https://github.com/cdata/katsuobushi/tree/main/lib/sandbox"}
    thread_status: {value: directly_linked, src: hn_thread}
    summary:
      value: Nix-flake microVM recipe for Claude Code with declarative allowlists.
      basis: Repo documentation.

  - id: nix_opencode_with_mitm
    name: nix-opencode-with-mitm
    role: template
    default_source: nix_mitm_repo
    urls: {repo: "https://github.com/riedel/nix-opencode-with-mitm"}
    thread_status: {value: directly_linked, src: hn_thread}
    summary:
      value: Prototype using a MITM proxy outside the sandbox for network control (allowlist/proxy); the repo's README implements only the network side — token injection was the author's stated aspiration in the source HN comment, not a shipped feature.
      basis: "Repo README documents mitmproxy allowlist enforcement (default models.dev) and TLS termination only. The originating HN comment (by the repo author) frames token injection as a want, not a delivered mechanism: \"What I would really want is token injection outside the sandbox and good control over the network, why I tried integrating a mitm proxy...\""

  - id: separate_user_account
    name: Separate dedicated user account
    role: pattern
    default_source: hn_thread
    urls: {}
    thread_status: {value: mentioned_only}
    summary:
      value: A no-sudo user account proposed as "enough"; disputed on shared-kernel, blast-radius, and supply-chain grounds.
      ev: thread
    risk:
      assessed_tiers:
        value: [t1_accidents]
        ev: editorial
        basis: Shared kernel and home directory limit it to the accident tier — the thread's objections, which we endorse.

  - id: diy_container_plus_network
    name: DIY container + external network control
    role: pattern
    default_source: hn_thread
    urls: {podman: "https://podman.io/", pfsense: "https://www.pfsense.org/"}
    thread_status: {value: mentioned_only}
    summary:
      value: Podman image with a mounted /workspace, no credentials in the container, egress restricted with pfSense and VLANs.
      ev: thread
      basis: One commenter's described architecture — the container boundary treated as good enough when egress and credentials are controlled elsewhere.
    risk:
      assessed_tiers:
        value: [t1_accidents, t2_exfiltration]
        ev: editorial
        basis: External egress control plus credential exclusion addresses exfiltration even with a container-tier compute boundary.

  - id: k8s_pvc_per_agent
    name: Kubernetes + PVC per agent session
    role: pattern
    default_source: hn_thread
    urls: {kubernetes: "https://kubernetes.io/"}
    thread_status: {value: mentioned_only}
    summary:
      value: Pod-per-agent with persistent volumes for agent state folders.
      ev: thread

  - id: separate_machine_proxy_helper
    name: Separate machine + proxy + helper binary
    role: pattern
    default_source: hn_thread
    urls: {}
    thread_status: {value: mentioned_only}
    summary:
      value: Disposable VMs on another box, a credential-hiding proxy, and a host helper to spawn them.
      ev: thread
    risk:
      assessed_tiers:
        value: [t1_accidents, t2_exfiltration, t3_hostile_escape]
        ev: editorial
        basis: Physical/VM separation plus a credential-hiding proxy covers all three tiers, at high DIY cost.

  - id: raspberry_pi_off_laptop
    name: Raspberry Pi off-laptop box
    role: pattern
    default_source: hn_thread
    urls: {official: "https://www.raspberrypi.com/"}
    thread_status: {value: mentioned_only}
    summary:
      value: Physical isolation for experiments on a separate cheap machine.
      ev: thread
    risk:
      assessed_tiers:
        value: [t1_accidents, t3_hostile_escape]
        ev: editorial
        basis: A separate physical machine is a hardware-grade containment boundary; exfiltration still depends on what network and secrets you give it.

  - id: vm_substrates
    name: General VM / container substrates
    role: pattern
    default_source: hn_thread
    thread_status: {value: mixed}
    summary:
      value: General-purpose isolation substrates suggested as bases rather than agent products.
      ev: thread
    members:
      - {name: QEMU/KVM, url: "https://www.qemu.org/"}
      - {name: quickemu, url: "https://github.com/quickemu-project/quickemu"}
      - {name: Vagrant, url: "https://developer.hashicorp.com/vagrant"}
      - {name: Incus, url: "https://linuxcontainers.org/incus/"}
      - {name: UTM, url: "https://mac.getutm.app/"}
      - {name: mkosi, url: "https://github.com/systemd/mkosi"}
      - {name: podman-machine-os, url: "https://github.com/podman-container-tools/podman-machine-os"}
      - {name: Firejail, url: "https://github.com/netblue30/firejail"}
      - {name: Docker (no exposed ports), url: "https://www.docker.com/"}
      - {name: Apple containerization example, url: "https://github.com/apple/containerization/tree/main/examples"}
      - {name: devcontainers, url: "https://containers.dev/"}
      - {name: "hardening primitives (AppArmor, bwrap, libseccomp, gVisor, Firecracker)", url: null}
      - {name: FreeBSD jails, url: "https://docs.freebsd.org/en/books/handbook/jails/"}
  - id: wasm_substrates
    name: WASM runtimes as alternative substrate
    role: pattern
    default_source: hn_thread
    thread_status: {value: mentioned_only}
    summary:
      value: Cloudflare workerd/Workers and container2wasm proposed as lower-footprint substrates for agent sessions.
      ev: thread
    members:
      - {name: Cloudflare workerd, url: "https://github.com/cloudflare/workerd"}
      - {name: container2wasm, url: "https://github.com/container2wasm/container2wasm"}

  - id: claude_cowork_reference
    name: Claude Cowork (containment reference)
    role: pattern
    default_source: anthropic_containment
    urls: {engineering: "https://www.anthropic.com/engineering/how-we-contain-claude"}
    thread_status: {value: mentioned_only, src: hn_thread}
    summary:
      value: Anthropic's local-VM knowledge-work agent, used in the thread as a comparison point for vendor containment across products.
      basis: Anthropic containment engineering post.

# -----------------------------------------------------------------------------
# Source stack — priority ordering for the site's evidence links.
# -----------------------------------------------------------------------------
source_stack:
  - {priority: highest, kind: official_product_docs_and_readmes, why: "Where execution model, network policy, persistence, and integrations are actually documented."}
  - priority: very_high
    kind: vendor_containment_engineering_posts
    examples: [anthropic_containment, anthropic_sandboxing, codex_security]
    why: Best primary material on agent threat models and why sandboxing needs approvals plus network control.
  - {priority: high, kind: official_pricing_and_service_docs, why: Required for real cost comparison of managed offerings.}
  - {priority: high, kind: official_api_and_integration_docs, why: Integration surface is a major differentiator.}
  - {priority: medium, kind: repo_security_model_docs, why: "Often contain the best limitations language, especially for OSS tools."}
  - {priority: medium, kind: hn_thread, ref: hn_thread, why: "Discovery, adjacent approaches, and what practitioners think is missing."}