Skip to content

SANDBOX.md

Latest commit

 

History

History
93 lines (65 loc) · 2.21 KB

SANDBOX.md

File metadata and controls

93 lines (65 loc) · 2.21 KB

Sandbox System

Overview

The sandbox system provides platform-aware isolation for command execution. Located in src/attocode/integrations/safety/sandbox/.

Implementations

Implementation Platform Mechanism Status
BasicSandbox All Allowlist/blocklist Production
SeatbeltSandbox macOS sandbox-exec profiles Production
LandlockSandbox Linux 5.13+ Landlock LSM syscalls Production
DockerSandbox All (Docker) Container isolation Production

Platform Detection

With mode: "auto" (default):

  1. macOS → SeatbeltSandbox
  2. Linux 5.13+ → LandlockSandbox
  3. Docker available → DockerSandbox
  4. Fallback → BasicSandbox

Configuration

Via Config

{
  "sandboxMode": "auto"
}

Via Builder

agent = (
    AgentBuilder()
    .with_sandbox(True)
    .build()
)

BasicSandbox

Validates commands against allowlists and blocklists before execution:

  • Default allowed: node, npm, git, python, pip, ls, cat, grep, etc.
  • Default blocked: rm -rf /, sudo, chmod 777, etc.

SeatbeltSandbox (macOS)

Uses sandbox-exec with dynamically generated profiles:

  • Restricts filesystem access to writable/readable paths
  • Blocks network access by default
  • Uses Apple's Seatbelt framework

LandlockSandbox (Linux)

Uses Linux Landlock LSM via ctypes syscall wrappers:

  • landlock_create_ruleset - Creates a new ruleset
  • landlock_add_rule - Adds path-based rules
  • landlock_restrict_self - Applies restrictions to the process

Requires:

  • Linux kernel 5.13+
  • PR_SET_NO_NEW_PRIVS capability
  • No root required

DockerSandbox

Full container isolation with:

  • Configurable memory and CPU limits
  • Mount-based filesystem access
  • Network isolation
  • Timeout enforcement

Policy Engine

The PolicyEngine determines permission levels:

Tool Default Policy Danger Level
read_file, glob, grep ALLOW Safe
write_file, edit_file ALLOW Low
bash PROMPT Medium
spawn_agent ALLOW Low
Unknown tools PROMPT Medium

Permissions can be persisted via the remembered_permissions table in SQLite.