My AI Agent Deploys Code to My Server. Here’s What Keeps It in a Box.

说明与用途

AI 代理将代码部署到 Linux 服务器。标准 Docker 容器共享主机内核，存在逃逸风险。通过安装 gVisor 并将 agentic-hosting 配置为始终使用 runsc 运行时，并施加严格的能力、文件系统和网络限制，部署被沙箱化，保护主机免受错误或恶意代码的影响。

问题

When an AI agent deploys code to a server, there is a risk that buggy dependencies, misbehaving code, or malicious behavior could compromise the host system.

结果

Deployments are now confined to a gVisor sandbox, preventing container escape and limiting resource usage, thereby protecting the host from agent‑generated code failures or attacks.

工作流

• 1. Install gVisor’s runsc runtime on the server. 2. Register runsc with Docker via daemon.json. 3. Verify gVisor is available with docker info and a hello‑world test. 4. Deploy agentic‑hosting (ah) which checks for runsc on startup. 5. Agent registers and requests a service via the /v1/services API. 6. ah starts the container with runsc, drops all capabilities, sets no‑new‑privileges, read‑only root FS, limited scratch space, process, memory, CPU caps, and a private internal network. 7. Traefik routes external traffic through a separate network; app‑to‑app traffic is disabled. 8. Use the /v1/system/health/detailed endpoint to confirm gVisor is installed. 9. Inspect the container’s Docker inspect output to verify runtime, capabilities, and filesystem settings.

证据

Most apps today ship as containers. A container feels like its own small computer, with its own files and processes. It isn't one.

来源

gVisor is an open‑source project from Google that adds that wall. It gives each container its own kernel, written in Go, that runs as an ordinary program on the host.

来源

ah starts the container with these settings. They’re hardcoded in internal/docker/client.go, so you can read them yourself.

来源

In production, if Docker doesn’t list runsc, ah exits with this error: FATAL: gVisor runtime (runsc) not found in Docker daemon.

来源