The result you are building

Finished Result:

A sandbox profile and test suite that proves untrusted code cannot reach host credentials, unrelated files, internal services, unrestricted network destinations, excessive resources, or persistence beyond the job.

Use this guide when

An agent executes generated code, packages, build scripts, notebooks, or user uploads.
Outputs must be retained while the runtime is disposable.
You need reproducible evidence of isolation and resource controls.

Do not use it as a substitute for

Running untrusted code as a normal host user or inside a privileged container.
Mounting broad home directories, Docker sockets, cloud credentials, or production networks into the job.

Before you change anything

Collect these items first. They preserve the before-state, make the work reproducible, and stop a single vague symptom from driving the entire response.

Threat model, data sensitivity, trusted inputs, and required outputs.
Runtime image digest, kernel/isolation mechanism, user, capabilities, and mounts.
Network egress policy, DNS, proxy, metadata-service, and internal-service reachability.
CPU, memory, disk, process, time, output, and package limits.
Escape, secret, symlink, fork, disk, egress, persistence, and cleanup test evidence.

Stop Before Proceeding:

Do not execute when isolation depends only on application prompts, when host secrets or control sockets are mounted, or when the required network/data scope cannot be narrowed.

Understand the system before fixing it

Capability is not authority A tool may be technically able to act while policy, budget, ownership, or user intent still forbids the action. Keep execution permission explicit and revocable.

Deterministic boundaries contain probabilistic reasoning Models may propose plans, but schemas, allowlists, budgets, approvals, idempotency, and postconditions must decide what can actually happen.

Containers are packaging, not a complete trust boundary Namespaces and limits help, but privileged modes, host mounts, shared kernels, sockets, and vulnerable runtimes can collapse isolation.

Outputs cross the boundary too Archives, HTML, images, logs, and binaries can contain active content, symlinks, secrets, or decompression bombs. Validate before release.

Evidence-to-decision map

Start with the row that most closely matches the evidence. The first test isolates a layer; it is not permission to
make every available change.

   Evidence               Likely layer     First decisive check            What the result means

   Job reads cloud        Secret           Probe environment, mounts,      Secrets or credential brokers are reachable from the sandbox.
   credentials            boundary         metadata service, and agent
                                           sockets

   Process survives job   Lifecycle        Inspect host/process/cgroup     Cleanup does not terminate descendants or remove runtime
   end                                     after forced timeout            state.

   Code reaches           Network          Canary internal addresses and   Default network permits lateral movement.
   internal database      egress           DNS rebinding test

   Container controls     Control socket   Check mounts and attempt        Docker/Kubernetes socket grants host-equivalent control.
   host Docker                             harmless daemon query

   Output extraction      Artifact         Test absolute paths, `..`,      Release pipeline trusts attacker-controlled paths or sizes.
   writes outside         validation       symlinks, and archive bombs
   directory

Step-by-step procedure

Work in order and retain the output from each step. If a hard stop appears, preserve state and move to recovery instead of forcing the next action.

01 Write the threat and output contract Why: A precise boundary prevents a plausible fix from solving the wrong problem.

Do: Identify attacker control, secrets, required files, permitted packages, network destinations, runtime, and maximum consequence. Default unknown access to deny.

Read the result: The job can be described without broad host or network access.