Untrusted and agent-written code

Why it pays

• A kernel boundary Each sandbox is a KVM guest with its own kernel, not a container sharing the host's.
• Nothing worth stealing inside Keys stay in the broker; the guest holds placeholders that only work for the hosts their rules name.
• Contain the blast radius Scoped keys, budgets and host-side firewall rules limit what a compromised sandbox can do.

Step by step

1. Create an isolated sandbox for the code

   No environment, no secrets, a short life.

   CLI

   ID=$(harebox new --name untrusted --size small --no-env --ttl 900 | jq -r .id)

   Python

   box = hb.create(name="untrusted", size={"preset": "small"}, no_env=True, ttl_seconds=900)

   TypeScript

   const box = await hb.create({ name: "untrusted", size: { preset: "small" }, no_env: true, ttl_seconds: 900 });

2. Lock down outbound traffic

   Set host-side firewall rules that root inside the VM can't change.

   CLI

   harebox firewall set "$ID" --body '{"default_outbound": "deny", "outbound": [{"action": "allow", "protocol": "tcp", "ports": "443", "hosts": ["pypi.org", "files.pythonhosted.org"]}]}'

   Python

   hb.set_firewall(box.id, body={"default_outbound": "deny", "outbound": [
       {"action": "allow", "protocol": "tcp", "ports": "443", "hosts": ["pypi.org", "files.pythonhosted.org"]}]})

   TypeScript

   await hb.setFirewall(box.id, { body: { default_outbound: "deny", outbound: [
     { action: "allow", protocol: "tcp", ports: "443", hosts: ["pypi.org", "files.pythonhosted.org"] }] } });

3. Run it and collect the result

   Upload the code, run it with a timeout, read stdout and the exit code.

   CLI

   harebox file write "$ID" --path /home/user/job.py --from ./job.py
   harebox exec "$ID" --timeout 300 -- python3 /home/user/job.py

   Python

   hb.write_file(box.id, query={"path": "/home/user/job.py"}, body=open("job.py", "rb").read())
   result = box.run("python3 /home/user/job.py", timeout=300)
   print(result["exit_code"], result["stdout"])

   TypeScript

   const r = await box.run("python3 /home/user/job.py", { timeout_seconds: 300 });
   console.log(r.exit_code, r.stdout);

4. Erase it

   Delete destroys the sandbox's encryption key, so nothing is left behind.

   CLI

   harebox delete "$ID"

   Python

   box.delete()

   TypeScript

   await hb.deleteSandbox(box.id);

Tips

• Give the code a scoped API key, limited to its own sandbox, if it must call HareBox at all.
• Turn off snapshots for sandboxes that handle data you don't want stored.
• Treat anything the VM reports as untrusted input in your own systems, as HareBox does.