A free ebook, as a PDF and an EPUB

Secure shell execution for coding agents

Limits, a sandbox, an allowlist and an audit log: the shell layer that lets a coding agent run commands without risking the host, the secrets or the network.

The PDF opens in a new tab. Your details go to learnwithparam only. This does not subscribe you to the newsletter.

Look insidePages from the PDF, as they print.

  1. Page 3: A shell tool can do anything its user can, so each risk needs a control in code.
    Page 3: A shell tool can do anything its user can, so each risk needs a control in code.
  2. Page 7: The runner adds the wall clock and the output cap, and kills the whole group.
    Page 7: The runner adds the wall clock and the output cap, and kills the whole group.
  3. Page 12: A container adds memory, CPU and process limits the kernel enforces per run.
    Page 12: A container adds memory, CPU and process limits the kernel enforces per run.
  4. Page 14: Match isolation to who wrote the code you run.
    Page 14: Match isolation to who wrote the code you run.
  5. Page 21: The allowlist is code: sets per environment, argument rules and no shell.
    Page 21: The allowlist is code: sets per environment, argument rules and no shell.
  6. Page 24: One shell tool checks, runs and logs every call with its turn id.
    Page 24: One shell tool checks, runs and logs every call with its turn id.

What the ebook covers

  1. 1

    Why the shell is the agent attack surface

    A shell tool can do anything its user can, and the agent takes orders from every ticket and file it reads. Name the risks before choosing the controls.

  2. 2

    The sandbox contract: four hard limits

    Every shell call gets a wall-time limit, a CPU cap, a memory cap and an output cap, plus a process cap, enforced by the kernel and the runner, not by the prompt.

  3. 3

    Container or rlimit: picking the isolation level

    Limits stop runaway commands; isolation stops reach. Pick the cheapest level that covers who wrote the code: rlimit, bubblewrap, a container, or gVisor and microVMs.

  4. 4

    Filesystem and network scoping

    The repo is writable, the system read-only, secrets absent and the network off unless a tool needs a named domain. Then close the holes the sandbox leaves open.

  5. 5

    A command allowlist by environment

    Start strict and widen only with evidence. Each environment gets its own set of commands, arguments are checked too, and shell syntax never reaches a shell.

  6. 6

    Audit log and blast-radius review

    Log every shell call with its turn id, then review the limits hit each week.

  7. 7

    The page to keep and the questions people ask

    Every layer of the shell tool on one page, then short answers to what engineers search about running agent commands safely.

See the lab this ebook comes fromSecure AI Agents with Guardrails: Agents that each sign in with their own identity, act only within the user's permissions and refuse an injected instruction.

See the labGet the ebook