Anthropic recently released a sandboxing tool based on bubblewrap (Linux, quite lightweight) and sandbox-exec (macOS).
https://github.com/anthropic-experimental/sandbox-runtime
replyI wonder if nsjails or gVisor may be useful as well. Here's a more comprehensive list of sandboxing solutions: https://github.com/restyler/awesome-sandbox
wow that's super new! Thanks for that, will look deeply into it and compare
reply> something that is truly local-first
replyHey, we built coderunner[1] exactly for this purpose. It's completely local. We use apple containers for this (which are 1:1 mapped to a lightweight VM).
1. Coderunner - https://github.com/instavm/coderunner
Very cool! Apple containers run on Apple ARM so it's complimentary to my stack which doesn't support ARM yet (but soon will when extending to Qemu which supports ARM). Thanks for sharing!
reply(sorry I didn't reply in-thread, I'm new to HN, re-posting response here:)
replyExactly! The main local requirement is to have hardware virtualization available (e.g. /dev/kvm) but that should be fine on your local linux machine. Won't work in cloud machines or on Mac ARM in current form but maybe if I extend
There are some providers that offer KVM nested virtualization, I think Google Cloud, Digital Ocean ... any others?
replyTrue! GCP does. I haven't tested it yet. I didn't know D.O does. If anyone knows others, I'm interested too!
replyWe (NanoVMs) can run (both unikernel and normal linux) virtualized workloads on plain old ec2 instances (eg: t2.small).
replyInteresting, thanks for sharing!
replyAre there any such solutions that can adequately protect against side-channel attacks (à la rowhammer, meltdown, spectre, ...)? I mean protecting local file access and network access is pretty easy, but side-channels and VM escaping attacks seem like a bigger concern.
replyThat's an interesting direction! TEE support would be relatively straightforward with current stack (and it's on my roadmap), so that could be a first step forward.
replySide-channel attacks apply to multi-tenant cloud environments, not local.
replyThat seems like a naive take. If any of your local VMs are internet connected and are compromised, side channel attacks could be used to exfiltrate data from other VMs or the host.
replyThen why only apply to VMs, why not apps?
replyhttps://rstrict.cloud/ is a CLI built in Rust on top of the Landlock API for the Linux kernel.
replyIt lets you narrow the permission scope of an executable using simple command line wrappers.
Thanks, will study that one too!
replyLocal-first (on Lunix), POSIX shell: https://github.com/sandbox-utils/sandbox-run
replyThanks for sharing, adding it to my list.
replyWhat about this: https://github.com/apple/container
replyVery cool one. That's dedicated to Apple ARM which I don't currently support so the two are complimentary. Apple containers shares some primitives with Kata. I'll investigate if it's possible to use Apple containers as a VMM inside Kata, or creating an Apple Containers runtime class in Kubernetes. If either is possible, we could then potentially use Apple containers as a backend in Katakate. I need more time to study that.
reply