[zredlined]

Run frontier agents on a machine you expect them to break: their controls live on another machine they can't reach, and every allowed request counts against a budget.

The egress usage monitoring builds on Hugging Face's proof of concept and RFC by Hugo Larcher; we're building this together with the Hugging Face team.

The setup is one k3s cluster across two or more machines:

• Control node: the k3s server, the OpenShell gateway, every sandbox's supervisor, and an egress watchdog.
• Sandbox node: runs sandbox workloads and nothing else. More sandbox nodes join the same way.

It uses released OpenShell 0.1.4 with no changes to OpenShell.

Try it

You need two Ubuntu 24.04 machines or VMs that can reach each other. From projects/use-case-examples/agent-containment:

# On the control node
CONTROL_IP=<control-node-ip> deploy/control-node.sh      # prints the sandbox-node command
# On each sandbox node
NODE_IP=<sandbox-node-ip> deploy/sandbox-node.sh <token> <control-node-ip>
# On the control node
deploy/watchdog.sh
deploy/verify.sh

deploy/rehearse-k3d.sh runs the same thing on a single Docker host, without sudo.

Exfil budgets live in the sandbox policy

The watchdog counts the bytes each sandbox sends to each allowed host. When a sandbox goes over its budget, the watchdog denies the request and quarantines that sandbox. The budget sits in the sandbox policy, next to the rules it constrains:

network_middlewares:
  egress-watchdog:
    middleware: egress-watchdog
    on_error: fail_closed
    config:
      budget:
        bytes_per_minute: 1048576   # on_exceed: deny (default) or finding
    endpoints:
      include: ["httpbin.org"]

Feedback wanted on this shape:

• names and units;
• per-host vs per-sandbox budgets;
• what else belongs here, such as requests per minute or writes per minute.

Tested

On a DGX Station (control node) and a DGX Spark (sandbox node), both arm64 and on the same local network:

• From zero: control-node.sh took 42 s and sandbox-node.sh 13 s. verify.sh passes all 9 checks: placement, allowed and refused requests, and watchdog accounting.
• Exfil: 64 KiB POSTs to an allowed host get sixteen 200s (1 MiB), then 403s, including a follow-up GET.
• Added latency: about 1 ms at p50 and 3 ms at p90, over 60 requests against httpbin.org.
• Boundary: from a root shell on the sandbox node, all of these are refused:
  • the node credential reading the gateway's keys;
  • the join token fetching the cluster CA (the sandbox node gets a join-only token);
  • the gateway API without a client certificate;
  • the watchdog without a valid token.
• Unit tests: 22 (uv run pytest).

What's next

• The control node can cut the sandbox node off. The sandbox node is wired only to the control node, so the control node can disconnect its network outright.
• Escape tripwire on the control node. If the sandbox node starts a connection it never should, or its node credential probes for secrets, the control node cordons it and stops its sandboxes.
• Stage-two quarantine. Swap in a deny-all policy and detach providers, keeping the sandbox for forensics.
• More detectors. A fleet detector (many sandboxes writing to one host), plus requests/min and writes/min budgets.

[github-actions]

Documentation preview

View the deployed preview

Built from 71445fa.