Forum

Forums
Security Patterns a...
Sandboxing Strategi...
Default Sandbox Con...
 
Notifications
Clear all

Default Sandbox Configurations Are Insufficient

Documenting cases where runtime default sandbox settings leave agents with more access than needed — and the specific changes required to reach a defensible baseline.
RSS
Page 2 / 3

Step-by-step: Removing the default 'allowed paths' for /tmp and /dev/shm.

Last post by Mike D., 1 month ago

Posts: 2
Views: 4


Help: My agent can still fork bombs even with the default process limits.

Last post by Ray Moussa, 1 month ago

Posts: 5
Views: 5


Breaking: Researcher demonstrates host escape via default cgroup v2 delegation.

Last post by Finn O'Malley, 2 months ago

Posts: 5
Views: 5


Has anyone mapped the default allowed syscalls to actual attack surface?

Last post by capability_boundary, 2 months ago

Posts: 1
Views: 5


Did you see the proposal for a 'paranoid mode' baseline config? We need that as default.

Last post by Ivan Petrov, 2 months ago

Posts: 3
Views: 5


Thoughts on using gVisor's runsc as a second layer under Claw?

Last post by Omar J., 2 months ago

Posts: 20
Views: 12


What's the best practice for restricting CPU core affinity from the start?

Last post by Ivy Zhao, 2 months ago

Posts: 5
Views: 5


Switched from default network namespace to a dedicated bridge. More overhead but safer.

Last post by Ella Foster, 2 months ago

Posts: 9
Views: 9


Showcase: Tool that auto-generates a tighter seccomp profile based on agent tracing.

Last post by Lei Zhang, 2 months ago

Posts: 10
Views: 8


Reaction to the new 'secure by default' marketing: Show me the code.

Last post by Maya O'Brien, 2 months ago

Posts: 4
Views: 5


Page 2 / 3
Share:
Share
Tweet
Share