Sandboxing Code

Giving an agent the ability to run code is incredibly powerful. It can analyse data, test its own work, and fix bugs. It's also like handing your computer to a stranger. So you need a sandbox. A room that the code can't get out of.

• Running code is powerful
• Like handing a stranger your computer
• Build a room it can't leave

A basic sandbox

Here's a first step. We run the code in a separate process, in an empty temporary folder, with an empty environment, so there are no keys to steal. And we set a time limit. Three tests. A sum, an endless loop, and an attempt to read a secret. Run it. The sum works. The loop gets stopped. And the secret isn't there. This is better than nothing, but a real attacker could still reach the network and your files.

import subprocess, sys, tempfile

def run_untrusted(code, seconds=2):
    with tempfile.TemporaryDirectory() as folder:
        try:
            r = subprocess.run([sys.executable, "-I", "-c", code], cwd=folder, env={},
                               capture_output=True, text=True, timeout=seconds)
            return r.stdout.strip() or r.stderr.strip().splitlines()[-1]
        except subprocess.TimeoutExpired:
            return "Stopped: took too long"

print(run_untrusted("print(sum(range(100)))"))
print(run_untrusted("while True: pass"))
print(run_untrusted("import os; print(os.environ.get('API_KEY', 'no key here'))"))

4950
Stopped: took too long
no key here

A proper container

For real isolation, use a container. This Docker file creates a non root user. Then we run it with strong limits. No network. A read only file system. Limits on memory and CPU. And we throw the container away after each run. For hostile code, use a stronger barrier, such as a micro virtual machine, or a hosted sandbox service.

FROM python:3.13-slim
RUN useradd --create-home runner
USER runner
WORKDIR /home/runner

Running with limits

Here's the kind of command that you'd use. Each flag closes a door. No network means that data can't get out. Read only stops it changing files. And the memory limit stops it from taking down the machine.

echo 'docker run --rm --network none --read-only --memory 256m --cpus 0.5 --user runner agent-sandbox python task.py'
docker run --rm --network none --read-only --memory 256m --cpus 0.5 --user runner agent-sandbox python task.py

Levels of isolation

Choose by how much you trust the code. A separate process is enough for your own code. A container suits code written by a model. A micro virtual machine suits code from strangers. And for coding agents, a human review of each command is often added on top.

Summary