🤔 Problem

We added a buildpack that will install coding agents in Renku sessions. However we have no ability to sandbox them.

The problems we want to protect users against are:

• the agent deleting remote branches on the repository
• the agent deleting data from a data connector where the user has write access
• the agent reading saved user secrets

🍴 Appetite

6 weeks

🎯 Solution

The idea we discussed in an earlier pitch is to separate the session and where the agent is running in separate containers. The user can access the container via a tmux session. The socket for tmux can be shared between the session and the agent container.

The container that runs the agent is much more restricted:

• secrets are not mounted there
• data connectors are mounted as read-only
• the git credentials are not mounted in the agent container or the agent is somehow prevented from pushing to git repos

Other considerations

A first implementation of this can just apply the limitations in the same user container. Then the user would be required to pause, modify and resume the session in order to remove the agent and remove the limitations that come from sandboxing. This makes it so that we don’t have to run 2 different containers in the same session.

Potential sandbox image we could use: https://github.com/agent-infra/sandbox https://agent-sandbox.sigs.k8s.io/docs/getting_started/overview/

🚞 User stories / journeys