Don't want to say it's better, but I implemented Agent Circus (https://github.com/Embedded-Focus/agent-circus) which allows to lock AI agent harnesses into docker containers.

I'm using it as my main driver since months.

Support for running agent harnesses in unprivileged podman containers is on my feature list. :-)

Agreed. Network control and secret injection together with a microVM setup is as good as it gets right now, although I believe that we need more fine-grained tools down the road. It sounds like Microsandbox would be the perfect fit for what you are describing. I also built my own coding agent workbench on top of it (https://github.com/isolade/isolade). Microsandbox is quite cool, check it out: https://github.com/superradcompany/microsandbox

Eclipse Enclave does exactly that: There is an outbound firewall and secret injections, so that the agent never sees a real key. And it's fully open source: https://github.com/eclipse-enclave/enclave

maintainer, I would recommend trying out: https://github.com/smol-machines/smolvm

It has network filtering + placeholders for secrets.

OSS, no logins needed

For persistent-ish one-off apps https://xbin.dev/ (my project)

Has egress and ingress filtering, egress can be bound to host/internet/subnet or even better to internal apps (which are each separate netns) meaning you can do your own firewall/vpn/whatever per sandbox. Plus you control what other components in the sandbox env the app can communicate with.

Really not built for day-to-day dev work though, more like automating your company/life / getting rid of SaaS (e.g. for technical Founders / Sales etc, not exactly useful for dev work)

I use Linux Containers managed by Incus for working with Claude.

I have a dedicated container for that. It can run its own Docker daemon and other system services if needed.

Apart from the Claude login token, it has no SSH keys or other credentials. I push everything I need to it from the local machine. And I pull the Claude generated outputs from it.

Of course, this kind of setup requires a stack which can run or at least be tested without any credentials.

If you just need a python+venv sandbox with dev-first UX, no container build step needed, and no startup cost then I am using https://github.com/nzjrs/sandbubble in prod.

I havent used nor gondolin neither docker's solution, but curious to know what gondolin is missing (evaluating both for my personal use)? is it only the DX or something else, if DX, can you what exactly is missing?

thanks

ive been using https://github.com/Gerharddc/litterbox

https://github.com/e2b-dev/e2b

Does secret injection really prevent that the agent send my GitHub key somewhere? If it has access to it via env var, can it not just paste it somewhere?

What specifically do you want? I have:

https://github.com/pjlsergeant/byre -- slightly different security model, but lazer-focused on developer experience; my daily driver and I love it not just because I wrote it. The TUI is great for configuring and setting up instant boxes just how you want

https://pleasedonotescape.com/ -- a list of every other agent jail I could find, filterable by open-source and whatever else you want

What I run is one hardened QEMU/KVM VM per project holding the whole dev environment (editors, agents, containers), with nftables on the host allowing internet egress but dropping anything aimed at the host, the LAN, or any other private address, plus an allowlist for deliberate exceptions.

Basically, it's a plain QEMU/KVM VM on a stock Debian cloud image: device model stripped down to a virtio disk, a virtio NIC and a serial console, nested virt off, no passwordless sudo in the guest. It also ships a containment check that scans outward from inside the guest, so the network boundary is something you can verify.

Wrapping the whole environment rather than a single agent session puts supply chain attacks inside the boundary too. A poisoned npm or PyPI package, or a compromised editor extension, lands in the VM instead of on the host. That was the original reason I set this up; agents just made it more urgent.

There's no per-domain egress allowlist; the policy is "internet yes, private addresses no". Secret injection isn't built in either, though Infisical's agent-vault on the host as an egress proxy covers that part.

Wrote the whole setup up here, in case it's useful:

https://karamatli.com/posts/network-isolated-kvm-sandbox-ai-...