Lesson 70 — Beginner

Sandboxed Execution for AI Agents

Agents jo code likhte hain wo kabhi bhi tumhare production process ke andar direct execute nahi hone chahiye. Is lesson mein dekhenge kyun, container jaisa sandbox kaise banta hai, filesystem/network/time kaise restrict hote hain, aur results ko safely capture karke kitna hi wapas bhejte hain.

In-process execution kyun khatarnaak hai

• Secrets leak: process ke andar env mein DB URL/token hain — code `os.environ` se sab padh sakta hai.
• Poora filesystem: config, backups, dusre tenants ke files — sab readable, kuch delete-bhi.
• Resource hog: `while True:` ya bada dataset — poora service node jam jaata hai, dusre request bhi marein.
• Escape: dependency install, subprocess, network calls — in-process mein rukne ki koi line nahi.

Sandbox ke options

Spectrum hai — jitna control chahiye utna ownership, jitna convenience chahiye utna service. Chhote prototype se shuru, production par isolation ki guarantee chahiye.

• Container (Docker/Podman): images, network off, memory/cpu caps, read-only mounts — sab kuch flag se. Khud manage karna padta hai.
• Managed sandbox services (E2B, Modal jaise): API call par ready isolate env — fast, scale-friendly; vendor dependency hai.
• Subprocess + venv: sabse halka — par filesystem/network isolation weak, isolation ko tum khud banana padta hai.
• VM/gVisor-level isolation: sabse strong — untrusted ya multi-tenant code ke liye.

Restrictions — filesystem, network, time, resources

import subprocess

def run_sandboxed(code, timeout=20):
    proc = subprocess.run(
        ["docker", "run", "--rm",
         "--network", "none",            # internet band by default
         "--memory", "256m", "--cpus", "0.5",   # RAM + CPU cap
         "--read-only",                  # image filesystem padho-mat
         "-v", "/tmp/sbx:/work:rw",      # sirf ek chhota kaam-wala folder
         "python:3.12-slim", "python", "-c", code],
        capture_output=True, text=True, timeout=timeout,   # tool na mar jaaye
    )
    return {
        "stdout": proc.stdout[:4000],    # sirf zaroori wapas
        "stderr": proc.stderr[:2000],
        "exit_code": proc.returncode,
    }

• Filesystem: read-only root + ek chhota writable mount. Koi secret mount mat karo.
• Network: off by default; agar chahiye toh allowlist destinations — internet open karna sabse badi galti.
• Time + compute: timeout (proc aur sandbox dono), memory aur CPU caps — infinite loop khud maar jaayega.
• Credentials: sandbox ko token do hi mat — agar service chahiye toh scoped, short-lived, sirf wahi.

Output capture aur blast radius

def call_sandbox_tool(code):
    try:
        out = run_sandboxed(code, timeout=20)
    except subprocess.TimeoutExpired:
        return "code 20s mein khatam nahi hua — chhota karke try karo"
    if out["exit_code"] != 0:
        err = out["stderr"][:800]
        return f"code fail: {err}"   # model ko fix ka hint
    return {"result": out["stdout"], "files": list_files("/work")}
# agent ko stdout + zaroori files chhote format mein — na poora disk dump

• Capture the three: stdout, stderr, exit code — tino nahi toh model andaze se fix karega.
• Truncate + filter: lakho lines ka stdout wapas mat bhejo — top-N lines, important files, ya summary.
• Blast radius: har action ka maximum nuksaan socho — sandbox alag ho toh worst case ek VM mara, poora cluster nahi.
• Audit: kaunsa code chala, kya output aaya, kisne allow kiya — log rakho, production mein yahi evidence bachata hai.

Exercise

Common mistakes

• Agent ke code ko in-process exec daal dena: os.environ se secrets, file system se data, infinite loop se service — sab exposed. Code generation ka matlab sandbox, hamesha.
• Sandbox mein bhi prod credentials daal dena: Isolation ka fayda tabhi hai jab andar kuch valuable na ho. Secrets bilkul mat do, zaroorat ho toh scoped aur short-lived token.
• Timeout/memory cap na rakhna: Code ghanton chalega ya RAM phayda dega — dono hi incident hain. Timeout (subprocess + container) aur memory cap dono mandatory.
• Poora output wapas bhejna: Lakh lines ka stdout model ka context kha jaayega. Truncated stdout/stderr aur files ka chhota list bhejo — wahi kaafi hai fix ke liye.

experiment: ghar (sandbox) -> test -> scale
agent code: sandbox -> verify -> (tabhi production mein deploy)
blast:       ghar jalaa? kuch nahi. restaurant jalaa? band!