ShrekOS in two diagrams: giving an agent exactly one folder and one hostname

This post provides a visual representation of how an untrusted workload, or "agent," can perform tasks on a host system without gaining significant access. The system, called ShrekOS, functions based on four key rules: deny all access by default, start with no files or network connectivity, grant capabilities one at a time, and revoke these capabilities as needed.

The core concept is the "Bench," a temporary environment that begins with no files or network access. The host system then grants the Bench specific resources, such as directories or network profiles, one at a time. These grants are pinned to specific objects, and any directories granted cannot be used to redirect files or execute code.

Network access is strictly controlled through sealed profiles, which specify limited destinations for the Bench to connect to. The host system resolves these profiles and pins the necessary network destinations, ensuring the Bench cannot access the internet or other external networks.

Credentials required for network access are handled by a separate broker outside the Bench. The Bench cannot directly access sensitive tokens or arbitrary network destinations, reducing the risk of unauthorized communication. Instead, the broker handles the credential-based calls, returning only the results to the Bench.

Overall, the ShrekOS design emphasizes disposability and strict capability control to minimize the potential impact of an untrusted workload on the host system. While the Bench can perform tasks, it is ultimately discarded after use, preserving the security and integrity of the host environment.