TinkerNothing run yet.the code runs in the sandbox · files: everything read and write · network: allow-list through the proxy · secret: held by the proxy, outside the sandbox
Chapter 2 of 7
Files
The sandbox stopped the attack in chapter 1. Now look at one wall of it: the filesystem. What the agent can read and write is set by what the sandbox mounts, and how.
This chapter: What does the sandbox mount, read-only or writable, and what does it hide?
You will learn
- Mounts: the paths the sandbox exposes, each read-only or writable
- Why a write to a read-only mount, and a read of a hidden path, are refused
- That the default is broad: what you do not want read must be hidden on purpose
Words you’ll meet (4)
- Mount
- A path the sandbox exposes to the agent, as read-only or writable.
- Read-only
- A mount the agent can read but not change.
- Hidden path
- A path the sandbox does not expose at all; a read of it is refused.
- Least privilege
- Giving the agent only the files and access the task needs, and nothing more.
The picture on the left is live. Each step below asks you to do one thing in it; the story continues here as you go.
Step 1 of 5
A note in this task tells the agent to read Larkspur’s private deploy key. The sandbox is on, but it mounts everything, read and write. Run it and watch the key come straight out.