Skip to content

Add cc-sandbox-server to Sandboxing & Isolation #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
weijiafu14 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add cc-sandbox-server to Sandboxing & Isolation #11

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,7 @@ Projects using **Linux** security primitives (and a few Mac exceptions) such as
| 🔥 [sandlock](https://github.com/multikernel/sandlock) | Landlock, seccomp, seccomp-notif | Process sandbox combining Landlock (filesystem + network + IPC), seccomp-bpf (syscall filtering), and seccomp user notification (resource limits, IP enforcement, /proc virtualization, port virtualization). No root, no cgroups, no containers. COW fork enables O(1) memory scaling — parent loads model once, children share via copy-on-write. See also the [architecture blog post](https://multikernel.io/2026/03/14/introducing-sandlock/). |
| 🔥 [ironclaw](https://github.com/nearai/ironclaw) | WASM, Linux namespaces, credential-injection | WASM-sandboxed tools (capability-based permissions, endpoint allowlisting), host-boundary credential injection where secrets never enter WASM memory. |
| 🔥 [amla-sandbox](https://github.com/amlalabs/amla-sandbox) | WASM, capabilities | WASM-based agent sandbox using wasmtime with a capability-based security model that enforces per-tool method constraints, call limits, and parameter validation before any tool invocation leaves the sandbox. |
| [cc-sandbox-server](https://github.com/weijiafu14/cc-sandbox-server) | split-brain, host-side credentials, crash-recovery | Instead of putting the agent in the box, keeps the harness, session, and credentials on the **host** and forwards only *tool execution* into a disposable sandbox (any substrate) over one persistent connection. Same binary runs agent mode on the host and `--tool-server` mode inside the sandbox, so tool behavior is byte-for-byte identical; a crashed sandbox is rebuilt from a per-task volume while the turn continues. An open implementation of Anthropic's "decouple the brain from the hands." |
| 🔥 [OpenFang](https://github.com/RightNow-AI/openfang) | WASM, taint-tracking | Uses a WASM dual-metered sandbox: wasmtime with both fuel metering and epoch interruption, backed by a watchdog thread that force-kills runaway code. Seeks to implement information flow taint tracking (secrets labelled from source to sink), Ed25519-signed agent manifests, and other techniques. |
| 🔥 [cua](https://cua.ai/docs/computer-sdk/computers) | containers, qemu | Computer-use agent SDK using Linux containers and QEMU-inside-Docker for full desktop environment isolation. See also the [qemu-docker library](https://github.com/trycua/cua/tree/699350bfba66ba8a0186ed9c98c8b084b32462be/libs/qemu-docker). |
| [goose + boxlite discussion](https://github.com/block/goose/issues/6040) | KVM, libkrun | GitHub issue discussing integration of boxlite KVM-based sandboxing into Block's goose agent framework. |
Expand Down