Security and Safety

Isolation boundary

Microsandbox is the intended isolation boundary for untrusted agent code. Local mode executes host subprocesses and must never be exposed to untrusted workloads. Network policy is represented in SessionLimits; the microsandbox adapter maps disabled/public/allowlist modes to the runtime.

Filesystem controls

normalize_sandbox_path rejects .. path components, strips the guest workspace prefix, and canonicalizes separators. resolve_host_path resolves against the session root, checks containment, and rejects symlinks. Archive extraction routes every member through the same resolver.

API controls

Bearer auth is optional, so deployments must set SANDBOX_AUTH_TOKEN whenever the service is reachable beyond a trusted local process. CORS currently allows all origins. There is no user/tenant identity model beyond the shared token and workspace IDs.

Hardening

Use per-caller credentials, strict CORS, request size limits, archive bomb protection, environment-variable filtering, command/resource quotas, audit logs, artifact authorization, and separate service accounts. Treat image references and snapshot metadata as untrusted inputs. Test symlink, tar traversal, zip traversal, timeout, output truncation, and cross-workspace restore cases.