Sandbox Policy Ladder

Pick the least costly isolation profile, refuse bad calls in a runner, and set sbx network, secret and safety policy.

The profile ladder#

Factor	process-fixture	filesystem-fixture	container-fixture	microvm-fixture
Cost	1	2	3	5
Filesystem control	no	yes	yes	yes
Network denial	no	no	yes	yes
Separate kernel	no	no	no	yes
Residual	`shared-host-kernel`, `network-not-denied`	`shared-host-kernel`, `network-not-denied`	`shared-host-kernel`	none

Command	What it does
`python3 projects/sandbox-ladder/solution/cli.py untrusted=true,secrets=true,network=true,host_kernel=false --budget 3`	Policy simulation, JSON out
`... --docker-image <image>`	Adds a `docker run` preview
`... --docker-image <image> --execute`	Runs two probes on a local image
`python3 scripts/project_test.py sandbox-ladder --stage 1 --path learning-artifacts/sandbox-ladder`	Grades stage 1 of your version
`python3 scripts/project_test.py sandbox-ladder --all --solution --strict`	Grades the reference
`python3 code/main.py`	Lesson demo, allow and deny battery
`python3 -m pytest code/tests/ -v`	Lesson tests

profile=container-fixture mode=policy-simulation os_isolation=false

residual=shared-host-kernelno separate kernel

verify=runtime-configuration-and-escape-testsalways printed

JSON wrapper keys from cli.py

"mode": "policy_simulation", "runtime_verified": false

docker run --rm --pull=never \local image only

--network none --read-only \no route, read-only root

--cap-drop ALL --security-opt no-new-privileges \

--pids-limit 32 --memory 64m --cpus 0.5 \

--user 65534:65534 <image> sh -c '<probes>'root_write, default_route

Deny wins: a deny beats an allow for the same hostname or CIDR.
deny_kind: implicit means no rule matched. explicit names the rule.
check network: host and port only, port 443 by default. It exits 1 on a denial.
forward-bypass: a tunnel with no inspection and no credential injection.
Secrets: the agent sees proxy-managed or sbx-cs-<rand>, never the value.
SSH agent: forwarding is on by default. Keys stay on the host.
Governance: only organization allow rules grant. Local deny rules still apply.
Boundary: the hypervisor, not in-VM privilege separation.

Factor	`strict`	`balanced`	`restricted`	`autonomous`
`safe` label	ask	allow	allow	allow
`destructive` label	ask	ask	deny	allow
`unknown` label	ask	ask	deny	allow

Setting	Default	Note
`max_output_bytes`	`64 * 1024`	Then the truncation marker
`timeout_seconds`	30.0	Demo uses 2.0
`DENIED_EXIT_CODE`	-100	Any refusal
`TIMED_OUT_EXIT_CODE`	-101	Wall-clock timeout
`env_allowlist`	`("PATH", "HOME", "LANG", "LC_ALL", "TERM")`	All other variables are dropped
`shell`	`False`	Metachars refused while off
`--budget`	3	Planner cost ceiling

Task	Code
Set the global preset once	`sbx policy init balanced`
List rules with their ids	`sbx policy ls --wide --json`
Allow one host for one sandbox	`sbx policy allow network --sandbox <name> example.com`
Deny a host at creation	`--deny-network <host>` on `create` or `run`
Predict one decision	`sbx policy check network --sandbox <name> <host:port> --json`
Read what the proxy decided	`sbx policy log` with `--json`
Remove an allow rule	`sbx policy rm network --sandbox <name> --id <uuid> --force`
Look for organization rules	`sbx policy ls --source org`

Symptom	Cause	Fix
`is on the denylist`	Basename of argv[0] is in `DEFAULT_DENYLIST`	Use another tool or change `denylist`
`use a script file instead of -c/-e`	Interpreter with an inline code flag	Write the code to a script file
`set shell=True to opt in`	Metachar in argv with shell off	Split the command into argv
`resolves outside project root`	`../`, an absolute path or a symlink out	Keep paths under `project_root`
`Limit` error from the planner	No sufficient profile within the budget	Raise `--budget`. A kernel needs 5
`Docker probe cannot establish independent guest kernel`	`--docker-image` with `host_kernel=true`	Use the policy simulation only
`conflicts with existing allow rule`	Deny over an allow in one scope	`sbx policy rm network` first
`403 Forbidden`, 90-byte body	No rule matched, approval required	Add an allow rule. It is not a network fault

Does network=true grant network?: No. It means network denial is required.
All four needs at budget 4?: Limit. Only microvm-fixture has a kernel, at cost 5.
Does the Docker probe prove a microVM?: No. It tests root write and the default route only.
Is the lesson sandbox an OS boundary?: No. It uses no namespaces, cgroups or seccomp.
Are agent permissions a boundary?: No. They run client-side. Use a sandbox for isolation.

Run unattended agents with --safety restricted.
Put destructive commands in deny. No mode or hook allow overrides it.
Store keys with sbx secret set, never with -e KEY.
Turn off ssh.agentForwardingEnabled for an agent you would not let sign.
A host allow passes any body. Narrow an API with a kit HTTP rule.
In production, add a container or microVM, drop capabilities, mount the root read-only.