Source note
The Blackwall Between Your AI Agent and Your Filesystem
Summary
greywall is a container-free sandbox for AI coding agents that cuts filesystem, network, and syscall access down to a profile instead of giving the agent your full user permissions. It targets a common safety gap in tools like Claude Code, Cursor, Codex, and Aider.
Problem
- AI coding agents usually run with the same permissions as the developer, so a bad command, unsafe dependency, or hallucinated shell action can touch SSH keys, shell config, cloud credentials, or any file in the home directory.
- Existing isolation often means Docker or VMs, which add setup cost, volume-mount friction, and toolchain breakage for routine coding work.
- A lighter least-privilege layer matters because the failure scope of current agent setups is often the whole machine account.
Approach
- greywall is a single-binary sandbox that applies deny-by-default controls without Docker or VMs.
- On Linux it combines bubblewrap namespaces, seccomp filters, Landlock filesystem rules, and eBPF tracing; on macOS it generates Seatbelt profiles with selective file and network access.
- It ships with built-in profiles for 13 agents and supports a learning mode that traces real file access with
straceand turns that trace into a reusable least-privilege profile. - Its command blocking parses shell structure, including pipes,
&&,||, subshells, and quoted strings, so blocked commands can still be caught when they are wrapped in shell syntax. - The design uses fallback behavior when a kernel feature is missing, so the sandbox can still run with reduced protection rather than fail outright.
Results
- The excerpt does not report benchmark scores or controlled security evaluation metrics.
- Claimed implementation scope: about 17,400 lines of Go, 4 direct dependencies, and 151 tests across 13 files.
- Claimed product coverage: built-in profiles for 13 AI agents, including Claude Code, Cursor, Codex, and Aider.
- Claimed syscall coverage: seccomp blocks 30+ dangerous syscalls such as
ptrace,mount,reboot,bpf, andperf_event_open. - Claimed project maturity signals: about 109 to 110 GitHub stars, 8 releases in 23 days, and a merged external contribution in a few hours.
- Reported limits: atomic file writes can break because temp files and targets may land on different filesystems inside the sandbox; WSL DNS issues and AppArmor conflicts with TUN devices are also named.