RUNTIME EXECUTION ENVIRONMENTS

CONTROLLED CAPABILITIES A sandbox is useful only if you decide carefully what is allowed inside. Three kinds of ability need tight control: running processes, touching files, and using the network. Process execution. A process is a running program. The harness decides which programs the agent may start. An allowlist is a list of permitted programs, and everything not on the list is refused. An allowlist is safer than a blocklist, which names only the forbidden programs, because attackers can find programs the blocklist never thought of. Resource limits also apply here. The harness caps how much processor time, memory, and running time a process may use, so that a runaway program cannot freeze the machine. File operations. The harness decides which folders the agent may read and write. A common design gives the agent a single working folder and blocks everything outside it. Another protection is mounting some folders as read-only, so the agent can look at the contents but cannot change them. Path safety checks guard against tricks such as using the text "../" to climb out of the allowed folder. Network access. By default the safest sandbox has no network at all. If the agent needs to reach the internet, the harness can allow only specific addresses, a policy called egress control. Egress means data going out. Controlling egress prevents a hijacked agent from sending your secrets to a stranger's server. These three controls together define the sandbox's real strength. A missing control is a gap that attackers can exploit, as the practice prompts in this chapter will help you find. Secrets deserve a final word. A secret is a password, key, or token. Never place secrets inside the sandbox unless the task truly needs them, and when they are needed, supply them in a narrow, short-lived way.