docs(security): nono comparison + exploration roadmap (links to #12 / #121) - #120
Merged
Conversation
nolabs-ai/nono is a Rust CLI that sandboxes agents with OS-native primitives (Landlock + seccomp-notify supervisor on Linux, Seatbelt on macOS) — no daemon/container/VM. It ships working versions of two things sandy has only evaluated (#12 broker-not-mount credentials) or roadmapped (the fanotify FAN_OPEN_PERM protected-path idea). Key finding: it's COMPLEMENTARY, not competing. nono's own docs say to run it inside a container/VM for a real guest/host boundary — which is exactly sandy's Docker perimeter. The recommended stack (container outside + capability/credential control inside) is sandy + nono's ideas. Most transferable piece: nono's localhost credential proxy (phantom token in the sandbox, real key never enters, L7 endpoint scoping, cmd:// host- side OAuth capture) is a shipped reference implementation of CREDENTIAL_BROKER_EVALUATION.md — and confirms the A2 trade-off (proxy-side injection requires terminating TLS). Linked from the eval doc. Provenance noted: drawn from nono's public docs, read-only, not verified. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Sequenced plan for the nono thread: Phase 0 (gate) validate nono runs inside a sandy container (--read-only/cap-dropped/no-new-privs + Docker seccomp — non-obvious, seccomp-notify is the high-risk unknown); Phase 1 borrow the credential-proxy pattern (issue #121, independent, parallel); Phase 2 positioning + Alec/nolabs-ai cross-recommendation (gated on Phase 0); Phase 3 longer-horizon (seccomp-notify↔fanotify, per-tool sandboxes, SPIFFE). Includes a kill criterion: if nono only runs in sandy by weakening sandy, drop the stack story. Linked from nono-comparison.md. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
rappdw
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds two docs under
docs/security/and links them from the milestone-#12 broker evaluation.nono-comparison.mdnolabs-ai/nonosandboxes agents with OS-native primitives (Linux Landlock + a seccomp-notify supervisor, macOS Seatbelt) — no daemon/container/VM. Conclusions: complementary, not competing (nono's own docs say to run it inside a container/VM — exactly sandy's perimeter); its credential proxy is a shipped reference implementation of #12 (phantom token, L7 scoping,cmd://host-side OAuth) that confirms the A2 TLS-termination trade-off; borrow nono's credential/identity layer, not its (shared-kernel) isolation primitive.nono-roadmap.mdSequenced exploration plan:
--read-only, cap-dropped,no-new-privileges, Docker seccomp) — non-obvious; seccomp-notify is the high-risk unknown. Spike report → decision gate (with a kill criterion: if it only composes by weakening sandy, drop the stack story).Provenance noted in both docs: from nono's public docs, read-only, not independently verified.
🤖 Generated with Claude Code