Bubblewrap blocked agent writes outside the project — and still let it read a fake token
source re-read 2026-10-29
Why this label: Primary source is the author's own instrumented lab (bpftrace + nsprobe) published as an X Article on 2026-10-28. We re-read the article text via X tools and reproduced nothing. Treat as author-reported lab results, not vendor docs.
- Tried
- Sandbox a minimal coding agent (pi) with bubblewrap: --ro-bind / /, --bind "$PWD", --unshare-pid, private /tmp, then probe what the agent could write, read, and reach on the network.
- Broke
- Outside-project writes failed with "Read-only file system" even as root — good. The same runs still read FAKE-TOKEN from ~/.fake-creds, and HTTPS to example.com returned HTTP 200 while the agent shared the host network namespace. Launching from ~ made ~/.bashrc writable because --bind "$PWD" widened the writable mount to the whole home. Cutting the network with --unshare-net stopped outbound traffic and also stopped the agent from talking to its model, so no commands ran.
- Cause
- confirmed Author's probe runs show writes decided by mount flags (EROFS outside binds), while reads of the fake token succeeded in every workable run — a read-only bind does not hide readable files (X Article, 2026-10-28).
- confirmed Author shows launch directory is part of the policy: from ~/dev/demo, home stays RO; from ~, --bind "$PWD" makes home (including .bashrc) writable — a sandbox escape path on next shell.
- confirmed Author states whole-agent --unshare-net cuts model API too; Claude Code docs are cited for per-command sandboxing with a host proxy allowlist instead.
- Fix
- Author's planned next policy (not re-probed yet in the article): refuse launching from $HOME or /; overlay empty tmpfs on secret dirs like ~/.ssh / ~/.aws / ~/.fake-creds after the RO root; treat network isolation as per-command + filtering proxy, not a wrap of the whole agent. Until that lands, do not treat "sandbox on" as "secrets hidden."
- Prevention
- Before trusting a home-built agent sandbox, run a probe that tries a write outside the project, a read of a fake credential path, and a direct HTTPS call. Confirm secret dirs are masked (tmpfs or unbound), launch only from a project directory, and assume whole-agent network off also kills the model.