I have a solution based on Nix that can be used to generate reproducible container images: https://github.com/nothingnesses/agent-images . It lets you customise which agents, harnesses, or any other packages you want included in the VM and it uses `agent-box` for sandboxing.
wonderful, will try to test this in smol machines as well
This looks like gvisor but is a vm like firecracker right? Any reason you did not want to use firecracker?
(I am testing this now as a backend for my pet project which currently supports firecracker and gvisor. No network.)
It's a batteries included alternative to firecracker with a couple of new ideas tossed into the mix i.e. portable like a container (bake into a single file and rehydrate the vm anywhere), dynamic resource allocation, etc.
What? Does using sbx require login? Bummer.
Yes and they have a specific subscription for managing sandbox policies across the enterprise: Docker AI Governance
You can create those manually but if you want to enforce those then you need the subscription