bwrap sandbox have no escape hatches

[runfalk]

I've previously used codex quite a bit (which also offers a bwrap based sandbox). I enabled it for dirge too expecting it to work in a similar way. However it seems like the sandbox is very rigid and it's not possible for the agent to ask for more permissions.

As an example I asked the model to get my WAN IP for which it used curl. As far as I understand, because of the strict --unshare-all there is no way for the agent to request additional permissions when operations fail.

I patched dirge to allow network within the bwrap sandbox and asked my agent to migrate a Python project from poetry to uv. It could use websearch to find information, but it couldn't run uv lock as the last step to create the lock file as that requires write access to ~/.cache/uv where uv caches package downloads.

I think it would be nice to allow the agent to request running outside the sandbox and/or additional file-system write permissions/network access for specific tool calls when running with bwrap sandboxing.

[yogthos]

Yeah, that sounds reasonable to me. Having a config for the sandbox where you could define safe paths would be pretty useful. @allen-munsch thoughts?

[allen-munsch]

agree, surfacing some config on sandbox would be a nice enhancement to get flexibility

edit: i forgot to mention, there was some level of interest in adding a better default deny egress story with better DNS/networking

[allen-munsch]

the link to the issue area is here:

dirge/src/config/mod.rs

Line 305 in a70afd8

/// TODO(sandbox-net): network filtering

https://github.com/search?q=repo%3Adirge-code%2Fdirge+TODO%28sandbox-net%29&type=code

[allen-munsch]

@runfalk if you're wanting a mirrored experience, the experimental microvm version of the sandbox has a broader allow list since its in a libkrun hypervisor via KVM, which would allow writes to ~/.cache/uv out of the box with a better security model, instead of loosening bwrap policy, it might be worth tightening the sandbox you're using if you have /dev/kvm, (the caveat here being its a default broadly open networking story, and a rough edge or two depending if you have plugins installed via janet-lang vm stuff)

See:

• https://github.com/dirge-code/dirge/blob/main/docs/microvm/INDEX.md
• https://github.com/dirge-code/dirge/blob/main/docs/microvm/SETUP.md

Which handles the cargo, maturin stuff for python uv decently when i tried it. It also mounts cwd via virtio-fs

You could fork this image adding poetry and uv as needed:

• https://github.com/dirge-code/dirge/blob/main/images/dev/Dockerfile#L31-L36
• https://github.com/dirge-code/dirge/blob/main/docs/microvm/CUSTOM_IMAGES.md#creating-a-custom-image

and use it for a more dedicated python dev sandbox