nolabs-ai/nono

We have taken to letting our agents use specific CLIs directly and we narrow down their access control with nono tool sandboxing via a customized Pi agent running headless. We have one agent that can use the aws CLI and nono feeds in a phantom SigV4 credential and then policy limits to just read-only http methods and certain L7 filtering on paths to limit its abilities - this means we can have it monitor and debug deployment failures without it doing any damage. It was all largely based off this example https://github.com/nolabs-ai/nono/tree/main/tool-sandbox-examples/aws-cli

… but not behavior. If you are trying to actually run autonomous agents securely you need something that lives outside the harness that actually blocks actions in a way that can't be prompted around. We use nono [1] for this internally, essentially blocking any actions we don't want agents to be able to do without human approval. Our developers can just run `task claude` or whatever their harness is) and it pre-wraps it with our profile that enforces: - Filesystem: read/write only the worktree plus dev-tooling dirs (Go, Doppler, Graphite caches, git common dir); explicitly no Docker socket and it can't edit its own Claude settings files (so it can't loosen its own permissions). - Network: …

If you don't want to do that, don't use a VM. I like nono: https://github.com/always-further/nono

This one was posted here recently; works quite well for me: https://github.com/lukehinds/nono

Think the strongest product nth space is https://github.com/nolabs-ai/nono for what it's worth. Plus it is a priority for that team so if you are having issues the no labs guys will likely fix it :)

I've been satisfied with using Pi inside of srt [0]. I launch with `srt pi` and get file system and network isolation. There is a seemingly infinite risk surface area to protect, but I think does a reasonable job of balancing security and convenience. I've also heard good things about nono [1] from colleagues, but I haven't personally tried it out yet. [0] https://github.com/anthropic-experimental/sandbox-runtime [1] https://github.com/nolabs-ai/nono