What if the #DockerSlim magic is applied to agent sandboxing... Catch me at #DEFCON to find out how I do it to protect my Mac from getting hacked by agents (no BlackHat, not selling anything :-))

Many AI / agent security tools and products rely on the HTTPS_PROXY environment variable to redirect and inspect network traffic, but many apps don't/won't work with those or will work around those, so you end up either with a security bypass or a broken app (where security blocks direct net access)

Funny how OpenAI and Anthropic, with Fable and Sol and their internal uber LLM versions, can't get authentication fully figured out in their products once you get off the happy path :-)

Funny how overnight Ralph Loops turned into Loop Engineering... Definitely sounds fancier :-)

Speaking of microVMs... rumor has it Apple is building native microVMs. That would be cool. Keeping my fingers crossed :-)

Interesting that it took so long AWS to expose its Firecracker MicroVMs (used for Lambda) as a service 🙂 aws.amazon.com/blogs/aws/ru...

Run isolated sandboxes with full lifecycle control: AWS Lambda introduces MicroVMs | Amazon Web Services

AWS launches a new serverless compute primitive, AWS Lambda MicroVMs. VM-level, isolated sandboxes with no shared kernel or resources between sessions. Rapid launch and resume, full lifecycle control,...

aws.amazon.com

Looks like the new Docker HQ is in Seattle... Docker 2.0 :) Still mostly empty

Crazy how the malware fires in the Node/npm ecosystem are spreading to the OS packages... Now quite a few Arch Linux packages are infected lwn.net/Articles/107...

Sad, Docker has more breaking changes now than when it was first created. Will have to stop updating it to lock down the behavior... so it works consistently

Sandbox Probe is a great tool to find holes in your coding agent sandboxes. Created by Andrew Martin ( @sublimi.no ) and his team at ControlPlane - github.com/controlplane...

GitHub - controlplaneio/sandbox-probe: Agentic sandbox enumeration: find security issues, and seed escape automation.

Agentic sandbox enumeration: find security issues, and seed escape automation. - controlplaneio/sandbox-probe

github.com

KubeCon CFP submissions this year are noticeably better. Very exciting!

Cursor coding agent deleting production DB is one of the recent agent horror stories... The OSO team has done a nice job collecting lots of other examples of AI agents going rogue 🙂 www.osohq.com/developers/a...

A registry of AI agent failures, exploits, and defenses | Oso

Track real-world AI agent breaches and exploits. See how and why agents fail and what security teams can do to defend production systems.

osohq.com

Another reason why Claude Code or any other agent harness shouldn't run outside a (properly configured) sandbox... CC nukes session data that it considers old whether you like it or not... no warning, no prompt 🙂

For the next Good Dockerfiles session, Ivan & I will be learning how 2 build our own Docker Hardened Images 2 see how they stack up to the regular images, the Wolfi images we built & the official Chainguard images. I'll be cool if someone who knows DHIs wants to join us (maybe even from #Docker :-))

Interesting sandboxing post from Anthropic engineering. The harness / agent loop approach outside sandbox is flawed though (when it comes to security, but it's a UX/ops trade off for them). www.anthropic.com/engineering/...

How we contain Claude across products

Anthropic is an AI safety and research company that's working to build reliable, interpretable, and steerable AI systems.

anthropic.com

Of course, the built-in sandboxing capabilities in agents have vulnerabilities in the areas where they are actually meant to protect. This null byte network bypass vulnerability in Claude Code's sandbox reminds me of the old network vulnerabilities from way back 🙂 oddguan.com/blog/second-...

Second Time, Same Sandbox: Another Anthropic Claude Code Network Sandbox Bypass Enables Data Exfiltration

For the second time in five months, Anthropic Claude Code's network sandbox lets a process inside reach hosts the user's policy says to block, and exfiltrate any data the process touches. Every Claude...

oddguan.com

With this Claude Code sandbox config will access to the AWS credentials file be blocked? Not really 😉

Follow up 2 how u can build your own minimal Wolfi-based container images with the OSS Chainguard tools & the "minimal" project Ritvik Arya created. This PoC agent uses various tools including BrowserBase & BrowserUse to reverse the Apko config from the official Chainguard Bun.js image catalog info

Crazy how brittle (and barely usable) local AI agent sandboxing is... You are pretty much on your own to keep them on a leash and to keep them from biting your ass :)

So now that Gitlab gave up on code hosting and collaboration are all the cool kids moving from GitHub straight to Codeberg :-)

Bummer that Bun.js is being rewritten in Rust :-(

The first batch of the follow up material for the "Assemble Your Own Chainguard Base Container Images" stream: An enhanced version of the "wolfictl" CLI ( github.com/GoodDockerfi... ) with new commands, extra flags and fixes.

GitHub - GoodDockerfiles/wolfictl: An enhanced version of the Chainguard wolfictl CLI used to work with the Wolfi OSS project

An enhanced version of the Chainguard wolfictl CLI used to work with the Wolfi OSS project - GoodDockerfiles/wolfictl

github.com

May 9 is THE day! Join us this Saturday at 9:30am Pacific time if you are awake. We'll create minimal container images with Ritvik Arya using his "minimal" project and the open source Chainguard tools... and maybe we'll make some pancakes too 🙂 youtube.com/live/V-5ju2x...

Assemble Your Own Chainguard Base Container Images

YouTube video by Cloud Native Container Craft with Ivan and Kyle

youtube.com

When you hear QEMU you probably think slow CPU emulation 🙂 But did you know that you can have MicroVMs with QEMU too? Firecracker and Cloud Hypervisor are not the only options if you are building your own sandboxing!

With the Warp Terminal going open source I can finally make those terminal blocks deletable... It was so annoying to have noisy command blocks that you can share, save as workflow, filter and do many other things, but NOT delete 🙂

If you don't control your AI agents, your agents control you :-)

Anthropic Mythos and its ability to find new vulnerabilities got a lot of buzz... A great way to counter it is to reduce the attack surface removing the software components you don't need, so Mythos can't find zero day vulnerabilities in them. Can't exploit what's not there 🙂

Nice to be able to compare the reverse engineered version of Claude Code with the original source code version 🙂

If you are in Amsterdam for KubeCon this session on Tuesday will be great to see AND it's powered by Ivan's Iximiuz Labs!

This week was a pretty cool Chainguard Assemble event and it was a great reminder that you can't have good Dockerfiles without good base images! But can you "assemble" your own Wolfi-based base container images?