Six hosted sandboxes say "isolated." None tells you which wall your agent ran behind
A Show HN went up yesterday for plimsoll , a Go daemon you run yourself that executes code an agent wrote. The sandbox part is ordinary. The interesting part is that every result carries the isolation tier the run actually got, as a value, and a request can demand a minimum tier before anything executes. That second half is the rare bit. plimsoll's own docs say they read the current documentation…
Six hosted sandbox services have been found to be incapable of providing information about the specific "wall" or isolation level a particular execution run was subject to. Neither Cloudflare nor Modal, two of the six services, return this information in their responses. Plimsoll, a Go daemon that executes code submitted by agents, has identified that all six services return only a value indicating the isolation tier achieved, but not the specific wall reached.
Plimsoll also notes that the tier values are ordered from weakest to strongest: process, container, kernel, and VM. When a request is made, users can set a minimum isolation requirement, and if the daemon cannot meet this requirement, an error indicating insufficient isolation is returned. This error distinguishes between a run that did not execute at all and one that may have executed but was limited by the isolation constraints.
The system includes a unique request ID for each request, which is echoed back in the response. This allows for tracking and comparison of requests and results, ensuring that if a request is retried, it is treated as a new request. Plimsoll provides a detailed report of runs, including SHA-256 digests of the request and result, provider information, tier, image identity, and timings.
This report allows for verification of whether a specific run was executed as claimed, as the digests remain constant for a given request and result. The system also addresses the issue of authorization, where agents need to call APIs and require tokens for network access. Plimsoll handles this by providing a client within the sandbox that communicates with an external broker, which checks the caller and route before attaching a credential specific to the run.
This process ensures that the agent's code cannot bypass the sandbox's isolation mechanisms by directly making unauthorized API calls.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
