Sandboxes Overview

These are recipes for running an agent inside a third-party sandbox while varlock holds the real credentials. The sandbox contains the agent; the credential proxy gives it placeholders and swaps in real secrets only on verified connections to hosts you allow.

Read the sandboxing guide first. It covers why the two layers belong together, varlock’s own built-in --sandbox (macOS jail or a container, no third-party install), and the shared setup every recipe below assumes.

Filesystem, process, and network isolation varies by tool, so check each recipe for its actual boundaries. None of these tools broker credentials, so varlock stays the wire injector. Reach for one when you already run that tool, need Windows, or want a different isolation model than the built-in sandbox offers.

Recipes

Minimal Task / microVM or process sandbox. macOS, Linux

Fence Seatbelt / bubblewrap + domain allowlist. macOS, Linux

yolobox Container, home dir stays on the host. macOS, Linux

Agent Safehouse Deny-first Seatbelt profiles. macOS

bubblewrap Linux namespaces (DIY). Linux

MXC Windows AppContainer (processcontainer). Windows 11

Tools that already broker credentials at the network boundary (Docker Sandboxes, microsandbox, Anthropic srt credential mask, and similar) are out of scope here. Use those on their own, or wait for varlock host bridging if you want varlock as the broker inside a microVM that cannot reach host loopback.