$ the-wire · showcase
Guardrails streams OpenAI Chat under guard, sandbox-runtime goes namespace-strict on Linux
By RepoJournal · Filed · About Agent Security · Composed from the cited sources · methodology
NVIDIA-NeMo/Guardrails landed the full OpenAI Chat streaming path through its guarded endpoint, and anthropics/sandbox-runtime tightened Linux namespace and filesystem behavior in ways that change what operators see by default.
feat(server): integrate OpenAI Chat streaming NVIDIA-NeMo/Guardrails
Buffered and streaming requests now share one input projection and check, with `stream: true` selecting streaming and `false`, `null`, or omission selecting buffered while request bytes forward unchanged. Operators can point a guarded endpoint at OpenAI Chat streaming clients without a separate pipeline.
linux: a sandboxed command stays in the namespaces made for it (#588) anthropics/sandbox-runtime
Every write deny on Linux is a read-only bind mount that only holds in the mount namespace it was made in, so the seccomp helper now stops a sandboxed command from creating a user namespace or mount namespace of its own. The change is on by default and is a change of behaviour, which matters if your sandboxed workloads depend on nested namespaces.
linux: a sandboxed command stays in the namespaces made for it anthropics/sandbox-runtime
A sandboxed command under the seccomp helper can no longer create or join namespaces or alter a mount tree, so the sandbox's mount-based denies stay in force. Published as on by default and explicitly flagged as a change of behaviour.
Terminated tunnels end anthropics/sandbox-runtime
Terminated TLS tunnels can hold their slot, three descriptors and up to 4 MiB for as long as the client or upstream leaves them so; at `maxTunnels` (256) every further CONNECT returns 503. The fix is not in any release yet, so pin or size accordingly until it ships.
The real path is the kernel's on every runtime anthropics/sandbox-runtime
Path resolution in the sandbox now follows the kernel's answer on every runtime, using `fs.realpathSync.native` off Windows and following a write deny on a not-yet-existing link name by name. Worth noting if your policy rules pin paths that traverse symlinks or `..`.
linux: no placeholder where no mount point can be made anthropics/sandbox-runtime
For an absent `denyWrite` path inside an allowed write path, bubblewrap could fail to make the host mount point and no sandboxed command would start (for example `bwrap: Can't mkdir /mnt/c/Program Files/X: Permission denied` on WSL 2). `mountPointFor` now decides what each absent deny path gets: nothing, a file, or a directory.
Action items
- → Review sandboxed Linux workloads for nested user or mount namespace use before adopting sandbox-runtime's new namespa... anthropics/sandbox-runtime [plan]
