Practical Agent Sandbox Configurations: FreeBSD Jails and macOS Seatbelt

# Add to /boot/loader.conf (requires reboot)
echo 'kern.racct.enable=1' | sudo tee -a /boot/loader.conf

# After reboot, verify:
sysctl kern.racct.enable
# kern.racct.enable: 1

# Edit /usr/local/etc/bastille/bastille.conf
sudo sysrc -f /usr/local/etc/bastille/bastille.conf \
    bastille_zfs_enable=YES \
    bastille_zfs_zpool=zroot

sudo bastille bootstrap 15.0-RELEASE

# Create loopback alias interface (one-time)
sudo sysrc cloned_interfaces+="lo1"
sudo sysrc ifconfig_lo1_name="bastille0"
sudo service netif cloneup

# Create the jail -- ~3 seconds with ZFS enabled
sudo bastille create agent-session-01 15.0-RELEASE 10.0.0.10

# Verify
sudo bastille list
sudo jls

# Create a bridge interface (one-time)
sudo ifconfig bridge0 create
sudo ifconfig bridge0 addm re0 up
sudo sysrc cloned_interfaces+="bridge0"
sudo sysrc ifconfig_bridge0="addm re0 up"

# Create VNET jail attached to bridge
sudo bastille create -B agent-vnet-01 15.0-RELEASE 192.168.86.201/24 \
    -g 192.168.86.1

# -B: use bridge interface (if_bridge)
# -g: set default gateway
# IP must be on the same subnet as re0

# Verify the jail has its own network stack
sudo bastille cmd agent-vnet-01 ifconfig
# Should show epair interface, not re0

# /etc/pf.conf -- agent jail isolation
# Egress interface (verified: re0 on nexus)
ext_if = "re0"

# Jail network (VNET jails on bridge)
jail_net = "192.168.86.200/29"

# Loopback jail network (non-VNET jails)
jail_lo = "10.0.0.0/24"

# LiteLLM proxy address (on host or separate machine)
litellm_proxy = "192.168.86.100"
litellm_port = "4000"

# FreeBSD package mirror
pkg_mirrors = "{ pkg.freebsd.org, pkg0.nyi.freebsd.org, \
                 pkg0.isc.freebsd.org }"

# Forge hosts agents may reach
forge_hosts = "{ github.com, api.github.com, \
                 gitlab.com }"

set skip on lo0

# NAT for jail traffic going outbound
nat on $ext_if from ($jail_net) to any -> ($ext_if)
nat on $ext_if from ($jail_lo) to any -> ($ext_if)

# Existing CNI NAT rules
nat-anchor "cni-rdr/*"
rdr-anchor "cni-rdr/*"

# Default: block everything
block in all
block out all

# --- Host rules ---
# Allow host outbound (operator traffic)
pass out on $ext_if proto { tcp udp } from ($ext_if) to any

# Allow SSH to host from LAN
pass in on $ext_if proto tcp from 192.168.86.0/24 to ($ext_if) port 22

# --- Jail egress rules ---
# DNS (required for package installation and git)
pass out on $ext_if proto { tcp udp } from $jail_net to any port 53
pass out on $ext_if proto { tcp udp } from $jail_lo to any port 53

# LiteLLM proxy -- the ONLY path to model APIs
# Jails talk to the proxy; proxy talks to api.anthropic.com etc.
pass out proto tcp from $jail_net to $litellm_proxy port $litellm_port
pass out proto tcp from $jail_lo to $litellm_proxy port $litellm_port

# Package installation (HTTPS to FreeBSD mirrors)
pass out on $ext_if proto tcp from $jail_net to $pkg_mirrors port 443
pass out on $ext_if proto tcp from $jail_lo to $pkg_mirrors port 443

# Forge access (git clone/push over HTTPS and SSH)
pass out on $ext_if proto tcp from $jail_net to $forge_hosts port { 22 443 }
pass out on $ext_if proto tcp from $jail_lo to $forge_hosts port { 22 443 }

# --- Block credential exfiltration ---
# Jails CANNOT reach:
# - Host SSH (port 22 on host IP)
# - Other LAN machines
# - Arbitrary internet hosts
# - Host nREPL, Prometheus, Grafana ports
block out log proto tcp from $jail_net to $litellm_proxy port { 22 3000 9090 7888 }
block out log proto tcp from $jail_lo to $litellm_proxy port { 22 3000 9090 7888 }

# Allow inter-jail on bastille0 (for jail-to-jail if needed)
pass on bastille0 all

# Syntax check (does not load)
sudo pfctl -n -f /etc/pf.conf

# Load rules
sudo pfctl -f /etc/pf.conf

# Verify rules loaded
sudo pfctl -sr | head -30

# Test from inside a jail
sudo bastille cmd agent-vnet-01 fetch -qo /dev/null https://github.com
# Should succeed (forge host allowed)

sudo bastille cmd agent-vnet-01 fetch -qo /dev/null https://evil.com
# Should fail (not in allowlist)

# Set 5GB quota per jail
sudo zfs set quota=5G zroot/bastille/jails/agent-session-01/root

# Verify
sudo zfs get quota zroot/bastille/jails/agent-session-01/root

# Pre-task snapshot
sudo zfs snapshot zroot/bastille/jails/agent-session-01/root@pre-task

# View what changed since snapshot
sudo zfs diff zroot/bastille/jails/agent-session-01/root@pre-task

# Rollback (requires stopping the jail)
sudo bastille stop agent-session-01
sudo zfs rollback zroot/bastille/jails/agent-session-01/root@pre-task
sudo bastille start agent-session-01

# Clean up snapshot when no longer needed
sudo zfs destroy zroot/bastille/jails/agent-session-01/root@pre-task

# Mount host site/ directory into jail at /mnt/site (read-only)
sudo bastille mount agent-session-01 \
    /home/jwalsh/ghq/github.com/jwalsh/www.wal.sh/site \
    /mnt/site nullfs ro 0 0

# Verify from inside jail
sudo bastille cmd agent-session-01 ls /mnt/site/index.org

# The agent can read but not write:
sudo bastille cmd agent-session-01 touch /mnt/site/test
# touch: /mnt/site/test: Read-only file system

# In Bastillefile
MOUNT /home/jwalsh/ghq/github.com/jwalsh/www.wal.sh/site /mnt/site nullfs ro 0 0

# Snapshot the host data
sudo zfs snapshot zroot/home/jwalsh@agent-work

# Clone it (cheap, copy-on-write)
sudo zfs clone zroot/home/jwalsh@agent-work \
    zroot/bastille/jails/agent-session-01/root/mnt/work

# Agent can write to /mnt/work without affecting the original
# When done, diff and cherry-pick changes
sudo zfs diff zroot/home/jwalsh@agent-work

# Install OpenJDK and Clojure inside the jail
sudo bastille pkg agent-session-01 install -y openjdk21 clojure rlwrap

# Set JAVA_HOME inside the jail
sudo bastille cmd agent-session-01 \
    sh -c 'echo "export JAVA_HOME=/usr/local/openjdk21" >> /root/.bashrc'
sudo bastille cmd agent-session-01 \
    sh -c 'echo "export PATH=\$JAVA_HOME/bin:\$PATH" >> /root/.bashrc'

# Copy deps.edn into jail (or mount project read-only)
sudo cp /home/jwalsh/ghq/github.com/jwalsh/www.wal.sh/deps.edn \
    /usr/local/bastille/jails/agent-session-01/root/root/deps.edn

# Start nREPL inside jail, bound to jail's IP
sudo bastille cmd agent-session-01 \
    sh -c 'cd /root && clojure -Sdeps "{:deps {nrepl/nrepl {:mvn/version \"1.3.0\"}}}" \
           -M -m nrepl.cmdline --bind 0.0.0.0 --port 7888'

# From host, connect to jail's nREPL
clojure -Sdeps '{:deps {nrepl/nrepl {:mvn/version "1.3.0"}}}' \
    -M -m nrepl.cmdline --connect --host 10.0.0.10 --port 7888

# Directly reachable since jail is on the same bridge as re0
clojure -Sdeps '{:deps {nrepl/nrepl {:mvn/version "1.3.0"}}}' \
    -M -m nrepl.cmdline --connect --host 192.168.86.201 --port 7888

;; Connect CIDER to jail's nREPL
(cider-connect '(:host "10.0.0.10" :port 7888))

;; Or with TRAMP (via Bastille method):
;; M-x cider-connect-clj with host=10.0.0.10, port=7888

# Allow host to reach jail nREPL (add to pf.conf)
pass in proto tcp from 192.168.86.0/24 to $jail_net port 7888
pass in proto tcp from 192.168.86.0/24 to $jail_lo port 7888

# agent-session/Bastillefile
# Bastille template for AI coding agent jail provisioning
#
# Usage:
#   sudo bastille template agent-session-01 /path/to/agent-session \
#       --arg LITELLM_HOST=192.168.86.100 \
#       --arg LITELLM_PORT=4000 \
#       --arg AGENT_NAME=agent-alpha

ARG LITELLM_HOST=192.168.86.100
ARG LITELLM_PORT=4000
ARG AGENT_NAME=agent

# --- Base system configuration ---
CMD touch /etc/rc.conf
CMD pw user mod root -h -

SYSRC sendmail_enable="NO"
SYSRC sendmail_submit_enable="NO"
SYSRC sendmail_outbound_enable="NO"
SYSRC sendmail_msp_queue_enable="NO"
SYSRC syslogd_flags="-ss"
SYSRC cron_flags="-J 60"

# --- Required packages ---
# bash and gmake are REQUIRED for Claude Code on FreeBSD
PKG bash gmake git gh ghq curl
PKG node npm-node22
PKG openjdk21 clojure rlwrap
PKG python311 py311-pip

# --- Shell configuration ---
# Claude Code requires bash; FreeBSD jails default to /bin/sh
CMD chsh -s /usr/local/bin/bash root

# --- Copy shell config files ---
CP root

# --- Install Claude Code ---
CMD npm install -g @anthropic-ai/claude-code

# --- Create credential directories ---
CMD mkdir -p /root/.config/gh
CMD mkdir -p /root/.claude
CMD mkdir -p /root/.ssh
CMD chmod 700 /root/.ssh /root/.claude

# --- Configure LiteLLM proxy as model endpoint ---
CMD echo "export ANTHROPIC_BASE_URL=http://${LITELLM_HOST}:${LITELLM_PORT}" >> /root/.bashrc
CMD echo "export OPENAI_BASE_URL=http://${LITELLM_HOST}:${LITELLM_PORT}" >> /root/.bashrc

# --- Set agent identity ---
CMD echo "export AGENT_NAME=${AGENT_NAME}" >> /root/.bashrc

# --- Resource limits (requires kern.racct.enable=1) ---
LIMITS memoryuse:deny=2G
LIMITS vmemoryuse:deny=4G
LIMITS maxproc:deny=100
LIMITS openfiles:deny=4096

# --- Mount host site/ read-only (operator fills in FSTAB separately) ---
# MOUNT requires absolute paths set at apply time

# --- Tags for management ---
TAGS agent-session ai-coding

# agent-session/root/root/.bashrc
export SHELL=/usr/local/bin/bash
export LANG=en_US.UTF-8
export EDITOR=vi
export JAVA_HOME=/usr/local/openjdk21
export PATH=$JAVA_HOME/bin:$HOME/.npm-global/bin:$PATH

# LiteLLM proxy (set by template ARG)
# ANTHROPIC_BASE_URL and OPENAI_BASE_URL set above

# Aliases
alias make=gmake
alias ll='ls -la'
alias claude='claude --dangerously-skip-permissions'

# Prompt shows jail name
PS1='[\u@jail:\h \W]\$ '

# agent-session/root/root/.profile
export SHELL=/usr/local/bin/bash
[ -f ~/.bashrc ] && . ~/.bashrc

# Create jail first
sudo bastille create agent-session-01 15.0-RELEASE 10.0.0.10

# Apply template
sudo bastille template agent-session-01 /path/to/agent-session \
    --arg LITELLM_HOST=192.168.86.100 \
    --arg LITELLM_PORT=4000 \
    --arg AGENT_NAME=agent-alpha

# Copy credentials (manual -- never in template)
sudo cp /home/agents/alpha/.config/gh/hosts.yml \
    /usr/local/bastille/jails/agent-session-01/root/root/.config/gh/
sudo cp /home/agents/alpha/.claude/.credentials.json \
    /usr/local/bastille/jails/agent-session-01/root/root/.claude/

# Mount site read-only
sudo bastille mount agent-session-01 \
    /home/jwalsh/ghq/github.com/jwalsh/www.wal.sh/site \
    /mnt/site nullfs ro 0 0

# Set ZFS quota
sudo zfs set quota=5G zroot/bastille/jails/agent-session-01/root

# Start the jail
sudo bastille start agent-session-01

#!/bin/sh
# jail-agent-session.sh -- create, provision, and start an agent jail
# Usage: ./jail-agent-session.sh <name> <ip> [litellm-host] [litellm-port]

set -e

NAME="${1:?Usage: $0 <name> <ip> [litellm-host] [litellm-port]}"
IP="${2:?Usage: $0 <name> <ip> [litellm-host] [litellm-port]}"
LITELLM_HOST="${3:-192.168.86.100}"
LITELLM_PORT="${4:-4000}"
TEMPLATE_DIR="/usr/local/bastille/templates/agent-session"
SITE_DIR="/home/jwalsh/ghq/github.com/jwalsh/www.wal.sh/site"

echo "Creating jail: $NAME at $IP"
bastille create "$NAME" 15.0-RELEASE "$IP"

echo "Applying template..."
bastille template "$NAME" "$TEMPLATE_DIR" \
    --arg LITELLM_HOST="$LITELLM_HOST" \
    --arg LITELLM_PORT="$LITELLM_PORT" \
    --arg AGENT_NAME="$NAME"

echo "Setting ZFS quota..."
zfs set quota=5G "zroot/bastille/jails/${NAME}/root"

echo "Mounting site read-only..."
bastille mount "$NAME" "$SITE_DIR" /mnt/site nullfs ro 0 0

echo "Taking baseline snapshot..."
zfs snapshot "zroot/bastille/jails/${NAME}/root@baseline"

echo "Starting jail..."
bastille start "$NAME"

echo "Jail $NAME ready at $IP"
echo "  Console: bastille console $NAME"
echo "  Run:     bastille cmd $NAME claude --print 'hello'"

# Apply a named built-in profile
sandbox-exec -n no-internet /bin/bash

# Apply a profile from a file
sandbox-exec -f /path/to/profile.sb /usr/bin/curl https://example.com

# Apply an inline profile string
sandbox-exec -p '(version 1)(deny default)(allow process-exec)' /bin/ls

# Pass parameters to a profile
sandbox-exec -D HOME=/Users/jwalsh -f profile.sb /bin/bash

;; agent-sandbox.sb -- restrict an agent process
(version 1)

;; Start by denying everything
(deny default)

;; Allow the process to execute
(allow process-exec)
(allow process-fork)

;; Allow reading system libraries and frameworks
(allow file-read*
    (subpath "/usr/lib")
    (subpath "/usr/share")
    (subpath "/System")
    (subpath "/Library/Frameworks")
    (subpath "/usr/local/lib")
    (subpath "/opt/homebrew"))

;; Allow reading the project directory
(allow file-read*
    (subpath "/Users/jwalsh/ghq/github.com/jwalsh/www.wal.sh"))

;; Allow writing ONLY to the project directory and /tmp
(allow file-write*
    (subpath "/Users/jwalsh/ghq/github.com/jwalsh/www.wal.sh")
    (subpath "/tmp")
    (subpath "/private/tmp"))

;; Allow reading home directory configs (read-only)
(allow file-read*
    (subpath "/Users/jwalsh/.claude")
    (subpath "/Users/jwalsh/.config"))

;; DENY reading credentials
(deny file-read*
    (subpath "/Users/jwalsh/.ssh")
    (subpath "/Users/jwalsh/.aws")
    (subpath "/Users/jwalsh/.gnupg")
    (literal "/Users/jwalsh/.netrc"))

;; Network: allow only specific hosts via localhost proxy
;; (The sandbox-runtime handles this via proxy)
(allow network-outbound
    (remote tcp "localhost:4000"))  ;; LiteLLM proxy only

;; Deny all other network
(deny network-outbound)
(deny network-inbound)

;; Allow mach lookups for basic system services
(allow mach-lookup
    (global-name "com.apple.system.logger")
    (global-name "com.apple.SecurityServer"))

;; Allow sysctl reads (needed by Node.js)
(allow sysctl-read)

sandbox-exec -f agent-sandbox.sb \
    -D HOME=/Users/jwalsh \
    /opt/homebrew/bin/node /opt/homebrew/bin/claude --print "hello"

{
  "sandbox": {
    "enabled": true,
    "filesystem": {
      "allowWrite": ["~/.kube", "/tmp/build"],
      "denyRead": ["~/.ssh", "~/.aws", "~/.gnupg"]
    },
    "network": {
      "allowedDomains": [
        "api.anthropic.com",
        "github.com",
        "*.github.com",
        "registry.npmjs.org",
        "pkg.freebsd.org"
      ]
    }
  }
}

{
  "sandbox": {
    "enabled": true,
    "failIfUnavailable": true,
    "allowUnsandboxedCommands": false
  }
}

{
  "sandbox": {
    "enabled": true,
    "allowManagedReadPathsOnly": true,
    "allowManagedDomainsOnly": true,
    "filesystem": {
      "denyRead": ["~/.ssh", "~/.aws"]
    },
    "network": {
      "allowedDomains": ["api.anthropic.com"]
    }
  }
}

npm install -g @anthropic-ai/sandbox-runtime

{
  "network": {
    "allowedDomains": [
      "api.anthropic.com",
      "github.com",
      "*.github.com",
      "registry.npmjs.org"
    ],
    "deniedDomains": [],
    "allowLocalBinding": false
  },
  "filesystem": {
    "denyRead": ["~/.ssh", "~/.aws", "~/.gnupg"],
    "allowRead": ["."],
    "allowWrite": [
      ".",
      "/tmp",
      "~/.claude",
      "~/.claude.json"
    ],
    "denyWrite": [".env", "config/production.json"]
  }
}

# Wrap Claude Code in the sandbox
npx @anthropic-ai/sandbox-runtime claude

# Or directly with srt
srt claude

# With custom settings
srt --settings /path/to/strict-settings.json claude

# Wrap an MCP server
srt npx -y @modelcontextprotocol/server-filesystem

{
  "network": {
    "allowedDomains": ["localhost"],
    "allowLocalBinding": false
  },
  "filesystem": {
    "denyRead": ["~/.ssh", "~/.aws", "~/.gnupg",
                 "~/.anthropic", "~/.config/openai"],
    "allowWrite": [".", "/tmp", "~/.claude"]
  }
}

# litellm_config.yaml
model_list:
  - model_name: claude-sonnet-4-20250514
    litellm_params:
      model: anthropic/claude-sonnet-4-20250514
      api_key: sk-ant-...  # real key, only in proxy config
  - model_name: gpt-4o
    litellm_params:
      model: openai/gpt-4o
      api_key: sk-...      # real key, only in proxy config

general_settings:
  master_key: "sk-litellm-master-key"  # proxy auth
  spend_tracking: true
  budget_duration: "1d"
  max_budget: 10.0  # $10/day per key

litellm --config litellm_config.yaml --host 0.0.0.0 --port 4000

export ANTHROPIC_BASE_URL=http://192.168.86.100:4000
export ANTHROPIC_API_KEY=sk-litellm-master-key
# Agent calls go to proxy -> proxy calls real API with real key

// sandbox-eval.ts -- run with: deno run sandbox-eval.ts
const buf = new Uint8Array(65536);
const n = await Deno.stdin.read(buf);
const code = new TextDecoder().decode(buf.subarray(0, n!));
try {
  const result = new Function(code)();
  console.log(JSON.stringify({ ok: true, result: String(result) }));
} catch (e) {
  console.log(JSON.stringify({ ok: false, error: (e as Error).message }));
}

npm install pyodide
NODE_PATH=./node_modules node -e "
  const { loadPyodide } = require('pyodide');
  loadPyodide().then(py => console.log(py.runPython('2+2')));
"