Skip to content

Launch Isolated Sandbox

Bring up a verified-isolated container and confirm health before any adversarial test runs in it.

Prerequisites

  • Approved test-plan.template.md for this run.
  • Target repo's authorization (own-project or signed third-party consent).
  • Sandbox-policy-compliant runtime (containerd / docker / podman) on the host.
  • Pinned-digest sandbox image.

Startup validation checks

  1. Image integrity. Verify image digest matches expected.
  2. Network deny. Probe a known-public host from inside the sandbox; expect failure.
  3. Filesystem isolation. Probe a forbidden host path from inside the sandbox; expect failure.
  4. Privilege drop. Confirm process is non-root, capabilities dropped, seccomp default-deny.
  5. Resource limits. Confirm CPU/memory/PID quotas applied.
  6. Audit start. Emit sandbox_launched event with test ID and image digest.

If any check fails: abort, do not run tests, file an audit event with reason.

Execution

  • Mount only the per-policy paths (/sandbox/target, /sandbox/data, /sandbox/findings).
  • Copy (not bind-mount) the target repo into the workspace.
  • Run the test plan; tools and adversarial-LLM workflows execute strictly inside the sandbox.

Teardown and sanitization

  1. Capture findings into /sandbox/findings/.
  2. Persist findings out (write-only) to a designated host path per policy.
  3. Stop and remove the container.
  4. Delete the workspace volume.
  5. Emit sandbox_torn_down event.

Suspected sandbox escape

If any signal suggests escape:

  • Halt all tests.
  • Snapshot the host state (file mtimes, process tree, network state) for evidence.
  • Do not delete the sandbox volume yet.
  • Engage SPB-14 incident response.
  • Treat any artifacts produced during the run as untrusted.

Sample command (illustrative)

Implementations vary; this is a concept, not a copy-paste recipe.

podman run \
  --rm \
  --read-only \
  --security-opt no-new-privileges \
  --security-opt seccomp=default-deny \
  --cap-drop ALL \
  --network none \
  --user 65534:65534 \
  --pids-limit 1024 \
  --memory 2g --cpus 0.5 \
  --tmpfs /sandbox/data:rw,nosuid,nodev,noexec \
  -v /persisted-findings:/sandbox/findings:rw,nosuid,nodev,noexec \
  ghcr.io/<image>@sha256:<digest> \
  /entrypoint test-plan.json