Runner and PlugsHow-to guides
Run the agent under the sandbox
Restrict the files and network the agent can reach, without a container.
blaise:sandbox runs the agent, and every command of the plugs after it, under Anthropic's
sandbox runtime: operating system limits on files
and network, using sandbox-exec on macOS and bubblewrap on Linux. It lives in
@blaiseagent/plugs-sandbox.
1. Check the machine
- macOS needs nothing more.
- Linux needs
bubblewrap,socatandripgrep. The plug checks at the start of a run and lists what is missing. - The sandbox starts a local network proxy, so the runner must be allowed to open a loopback port.
2. Add the plug
setup:
- use: blaise:git/worktree
- use: blaise:sandbox
with:
allowedDomains:
- github.com
- registry.npmjs.orgList sandbox after the plugs that must run unrestricted, such as the worktree, and before the ones
whose commands you want to limit. Everything after it is sandboxed, including the agent.
3. Tune the limits
| Goal | Input |
|---|---|
| Allow another domain | add it to allowedDomains |
| Block a domain that is allowed | add it to deniedDomains |
| Hide a directory | add it to denyRead |
| Allow writes to another place | add it to allowWrite |
| Protect a file in the checkout | add it to denyWrite (default .env) |
The agent can write to its working directory and the temporary directory, and read everything except
denyRead (by default ~/.ssh, ~/.aws and ~/.config/gcloud).
Things to know
- It sandboxes the runner's own machine only. Listed below a plug that switches the host, such
as
sshordocker, it fails at the start of the run with a message that says so. - Teardown is not sandboxed. Commands that plugs run while tearing down the environment run with the runner's own rights.
- A blocked request is a failed request. The agent sees a refusal from the network or the file system, not a prompt. Approvals from Blaise are not available yet.
For all inputs, see Shipped plugs.