corv

When their questionnaire asked me for feedback I specifically mentioned that I hoped they would not reduce visibility to the point of Github Actions.

I guess that fell on deaf ears.

I’ve heard this before that common doses are unnecessarily high but why is that? Patents?

Really goes to say something about starving artists

I happen to use a Mac, even when targeting Linux so I'd have to use a container or VM anyways. It's nice how lightweight bubblewrap would be however.

Consider one wanted to replicate the human-approval workflow that most agent harnesses offer. It's not obvious to me how that could be accomplished by dropping privileges without an escape hatch.

I like the bubblewrap approach, it just happens to be Linux-only unfortunately. And once privileges are dropped for a process it doesn't appear to be possible to reinstate them.

You're right that blocking on every operation would defeat the purpose! Shannot is able to auto-approve safe operations for this reason (e.g. read-only, immutable)

So the agent can freely explore, check logs, list files, inspect service status. It only blocks when it wants to change something (install a package, write a config, restart a service).

Also worth noting: Shannot operates on entire scripts, not individual commands. The agent writes a complete program, the sandbox captures everything it wants to do during a dry run, then you review the whole batch at once. Claude Code's built-in controls interrupt at each command whereas Shannot interrupts once per script with a full picture of intent.

That said, you're pointing at a real limitation: if the fix genuinely requires a write to test a hypothesis, you're back to blocking. The agent can't speculatively install a package, observe it didn't help, and roll back autonomously.

For that use case, the OP's VM approach is probably better. Shannot is more suited to cases where you want changes applied to the real system but reviewed first.

Definitely food for thought though. A combined approach might be the right answer. VM/scratch space where the agent can freely test hypotheses, then human-in-the-loop to apply those conclusions to production systems.

Thank you, good to know it landed :)

I'm pursuing a different approach: instead of isolating where Claude runs, intercept what it wants to do.

Shannot[0] captures intent before execution. Scripts run in a PyPy sandbox that intercepts all system calls - commands and file writes get logged but don't happen. You review in a TUI, approve what's safe, then it actually executes.

The trade-off vs VMs: VMs let Claude do anything in isolation, Shannot lets Claude propose changes to your real system with human approval. Different use cases - VMs for agentic coding, whereas this is for "fix my server" tasks where you want the changes applied but reviewed first.

There's MCP integration for Claude, remote execution via SSH, checkpoint/rollback for undoing mistakes.

Feedback greatly appreciated!

[0] https://github.com/corv89/shannot

Looks like the underdog beats it handily and easier deployment to boot. What's the catch?

I’m building Shannot, a human-in-the-loop sandbox for AI agents on production systems.

Instead of filtering commands with heuristics (which agents work around), it dry-runs entire scripts in a PyPy sandbox, captures every command and file operation, then shows you exactly what will happen before anything executes.

I’ve just added checkpoint/rollback so you can undo changes if something goes wrong. Currently working on example scripts for common sysadmin tasks (nginx config, log cleanup, cert audits, etc.)

https://github.com/corv89/shannot

The gist dismisses sandbox-2 as “might as well use Docker or VMs” but IMO that misses what makes it interesting. The PyPy sandbox isn’t just isolation, it’s syscall interception with a controller in the loop.

I’ve been building on that foundation: script runs in sandbox, all commands and file writes get captured, human-in-the-loop reviews the diff before anything executes. It’s not adversarial (block/contain) but collaborative (show intent, ask permission).

Different tradeoff than WASM or containers: lighter than VMs, cross-platform, and the user sees exactly what the agent wants to do before approving.

WIP, currently porting to PyPy 3.8 to unlock MacOS arm64 support: https://github.com/corv89/shannot

Great documentation of the problem! The bypasses logged all stem from the same root problem: policy sandboxes give agents constraints to optimize against.

I’ve been exploring a different model: capture intent instead of blocking actions. Scripts run in a PyPy sandbox providing syscall interception so all commands and file writes get recorded. Human reviews the full diff before anything touches the real system.

No policies to bypass because there’s nothing to block! The agent does whatever it wants in the sandbox, you just see exactly what it wanted to mutate before approving.

WIP but core works: https://github.com/corv89/shannot

I’ve been working on a different approach to this problem: syscall-level interception via PyPy sandbox rather than command filtering. This captures all operations at the OS level, so tmp.sh scripts and Makefile edits get queued for human review before executing.

It’s still WIP but the core sandbox works. Feedback greatly appreciated: https://github.com/corv89/shannot

When AI and robots take care of everything there is more time to make babbies

Absolutely. I’ll send you an email

Interesting! The sandboxing space definitely deserves more attention.

On the other side of the spectrum, we're working on a lightweight approach that augments user namespaces with libseccomp to filter syscalls via BPF.

https://github.com/corv89/shannot

We've been exploring libseccomp/BPF filters on top of bubblewrap namespaces for LLM sandboxing - the BPF layer lets you go beyond read-only mounts to syscall restrictions. Open to collaboration on pushing this further: https://github.com/corv89/shannot

I've replaced my OrbStack usage entirely with Podman Desktop and have zero issues with it, unlike with OrbStack.

In particular the 1TB VM disk image OrbStack uses wreaks havok with deduplicating backups. Their disk cache also caused me hours of debugging why my assets weren't up-to-date.

Admittedly the OrbStack GUI is super snappy tho.

Seeing Treeform here immediately made me think of Nim, and lo-and behold that's what the Javascript is generated from, cool!

Happy to see it get more attention here - it really is versatile

Awesome and in Nim!

> There’s also a Russian torpedo that uses a similar concept to “fly” at supersonic speeds underwater.

Supercavitation

The missing magic incantation to create your Brewfile:

brew bundle dump

It's really good but the fs caching has bit me a couple times before I realized what was going on.

Adieu Mozilla!

I’m glad to see M5Stack is supported!

This is great to hear but I’ve found Kagi’s Orion to be so good that I’m unlikely to switch

You can map ChatGPT to the action button and talk to it from the lock screen.

Another way of going about it would be to require transparent algorithms.

Any mass media platform could be problematic regardless of who owns it.

I get why one would flash OpenWrt on hardware that is no longer manufacturer supported but is there any indication that security is improved or at least equal before then?