Built for code you didn't write
Agents run code that nobody reviewed. HareBox assumes the guest is hostile: the tenant is root inside, and the protections that matter live outside the VM where root can't reach them.
Layers of isolation
Each layer, with what runs today.
- Full Ubuntu 24.04 VM Real VMs, locally
Its own kernel, root through sudo, real systemd, on KVM.
- Credentials proxy Works locally
The sandbox holds a placeholder. The real key is added on the way out, only for the host its rule names.
- Firewall root can't remove Simulated
Rules are API objects outside the VM, so a tenant with root still can't change them.
- Scoped API keys Works locally
Limit a key by action, sandbox, project, label, rate, budget and IP.
- Hard budgets Works locally
Dollar limits on an account, project, fleet, label or API key, with an action when reached.
- Environments Works locally
Variables, secret files and versions, plus a switch that keeps your secrets out of third-party sandboxes.
- Token, OIDC or mTLS on URLs Simulated
Atomic token rotation, with no window where the old link is open.
- Private mesh Simulated
An encrypted network between a project's sandboxes.
The controls that matter live outside the VM
Root inside a sandbox can change anything in the guest. So the parts that hold your keys and decide what leaves the machine sit where the guest can't reach them.
How the boundaries are drawn
The design assumes every sandbox is compromised and asks what the attacker can then reach. These are rules every component is built to; the list above says which parts run today.
- Hardware virtualization. Each sandbox is a KVM guest with its own kernel under Cloud Hypervisor. Nothing shares the host kernel the way containers do.
- The guest agent is not trusted. The control plane treats everything the VM reports as untrusted input.
- Real keys never enter the guest. The credentials proxy swaps a placeholder for the real key at the egress, only for the destination its rule names.
- Forks don't share secrets. Every fork gets a new machine ID and fresh entropy, so clones never generate the same keys.
- Third-party-safe environments. A switch keeps your own variables and secret files out of sandboxes you hand to customers.
- Delete is crypto-erase. Each sandbox's disk, memory and snapshots are encrypted with its own key, and deleting it destroys the key.
Data and compliance
EU only
Every sandbox runs in the EU, launching in France. HareBox chooses the site and reports where each sandbox runs.
Retention you control
Works locally
Turn off snapshots or monitoring per sandbox, and set account-wide retention for command history and output.
Audit log
Works locally
Every action on the account is recorded with who did it and from which key.
No certification yet. SOC 2 and ISO 27001 need an auditor and months of operation, which HareBox hasn't had. There is no SLA until there is uptime history to stand behind it.