{"slug": "re-network-none-is-your-best-friend-here-s-our-full-sandbox-config-gvisor-update", "title": "Re: --network none is your best friend — here's our full sandbox config + gVisor update", "summary": "A developer shared a hardened Docker sandbox configuration for MCP servers, combining --network none, gVisor's runsc runtime, and strict resource limits. The setup has been used to audit 8,764 MCP servers, catching syscall-level exploits like ptrace, bpf, and mount attempts.", "body_md": "Thanks [@custralis](https://dev.to/custralis) for the great feedback on [my article about Docker sandboxing](https://dev.to/edison_flores_6d2cd381b13/how-to-sandbox-an-mcp-server-with-docker-network-none-is-your-best-friend-3p97)!\n\nYou're 100% right — `--network none`\n\nalone isn't enough. Here's our actual L2 sandbox config that addresses every point you raised:\n\n```\ndocker run --rm \\\n  --runtime=runsc \\\n  --network none \\\n  --read-only \\\n  --cap-drop ALL \\\n  --security-opt no-new-privileges \\\n  --memory 256m \\\n  --memory-swap 0 \\\n  --cpus 0.5 \\\n  --pids-limit 64 \\\n  --tmpfs /tmp:rw,size=64m \\\n  --user 1000:1000 \\\n  mcp-audit-target\n```\n\nWe have all of these:\n\n`--read-only`\n\nrootfs`--tmpfs /tmp`\n\nfor temp files`--cap-drop ALL`\n\n(drops ALL capabilities)`--security-opt no-new-privileges`\n\n`USER 1000:1000`\n\n**Plus L2.5: gVisor (runsc runtime)** — the biggest upgrade. gVisor intercepts every syscall in userspace. The MCP server never touches the host kernel. This catches:\n\n`ptrace()`\n\nattempts (process inspection)`bpf()`\n\nattempts (eBPF kernel exploits)`mount()`\n\nattempts (filesystem escapes)`kexec_load()`\n\n(kernel replacement)We've audited 8,764 MCP servers with this sandbox. Full writeup:\n\n[I ran Anthropic's official MCP server in a gVisor sandbox](https://dev.to/edison_flores_6d2cd381b13/i-ran-anthropics-official-mcp-server-in-a-gvisor-sandbox-heres-what-happened-a6j)\n\nFor servers that need outbound calls, you're right that an egress proxy with allowlist is the right approach. That's on our roadmap as L2.6 (pinned allowlist proxy).\n\n*MarketNow — the trust layer for agent commerce. Follow on GitHub.*", "url": "https://wpnews.pro/news/re-network-none-is-your-best-friend-here-s-our-full-sandbox-config-gvisor-update", "canonical_source": "https://dev.to/edison_flores_6d2cd381b13/re-network-none-is-your-best-friend-heres-our-full-sandbox-config-gvisor-update-7ao", "published_at": "2026-07-11 02:34:47+00:00", "updated_at": "2026-07-11 02:41:23.463413+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "developer-tools", "ai-infrastructure"], "entities": ["gVisor", "Docker", "Anthropic", "MCP", "MarketNow"], "alternates": {"html": "https://wpnews.pro/news/re-network-none-is-your-best-friend-here-s-our-full-sandbox-config-gvisor-update", "markdown": "https://wpnews.pro/news/re-network-none-is-your-best-friend-here-s-our-full-sandbox-config-gvisor-update.md", "text": "https://wpnews.pro/news/re-network-none-is-your-best-friend-here-s-our-full-sandbox-config-gvisor-update.txt", "jsonld": "https://wpnews.pro/news/re-network-none-is-your-best-friend-here-s-our-full-sandbox-config-gvisor-update.jsonld"}}