agentOS Security Model

gist

agentOS is Rivet's sandbox for running untrusted code on behalf of a trusted caller: each actor boots a fully virtualized VM with a kernel-owned filesystem, process table, sockets, and permission policy, and guest JavaScript runs in a V8 isolate. No host syscalls are bound by default. The security boundary is sidecar ↔ executor; guest code is assumed hostile, while client-supplied config, mounts, and credentials are trusted and therefore not sandbox bugs. Isolation is per-VM even when VMs share a sidecar process. The host still has to harden itself, scope permissions, and prefer a fresh VM per untrusted task.

ideas

• Deny by default, kernel-mediated syscalls. Network, host mounts, and other host capabilities stay unbound until the client opts in; guest syscalls never open a real host process, filesystem, or socket.
• The boundary is sidecar ↔ executor. VM config, mount targets, credentials, and the permission policy are trusted client input; only the payload that runs in the executor is untrusted.
• Trusted policy, untrusted subject. Guest bypass of an applied permission, mount-root escape, resource exhaustion, or cross-VM read is in-scope; a malicious client config is not a sandbox bug.
• Isolation is per-VM, not per-process. Actors share no filesystem, memory, or crash fate even when the sidecar process that hosts them is shared for performance.
• The host is still your problem. agentOS contains guests; you still harden the client process, validate tokens, keep secrets on the host, and prefer a fresh VM per untrusted task.

quotes