So I’ll preface this by saying that this is a bit of a shill post, which for me is unfortunate since I’ve been lurking in Level1 sphere for a while (daily driving Looking Glass, trying to extend it with DPDK to 7km over 200gbps dark fiber, massive hpc homelab rack, etc etc.) and this is what my first post is.. Hi!
(In my defense the project is OSS, I just want it to succeed at least mildly and ideally find long-term maintainers, I have other companies to run..)
Aaanyways, I’ve been seeing Wendell talk about.. things (harnesses? sandboxes? meta-harnesses??) where the idea is that agents write code and can modify the harness itself from within itself. The likes of the new Deepseek thing, Intel SuperClaw etc.
I’ve been thinking about this problem too, and coming from more of a systems background those approaches do feel to me a bit ‘upside down‘. When you’re building an IT infra for anything more or less serious, everything is about boundaries and permissions. Most data processing systems and automations can be just rigid code and don’t need the vagueness of LLMs (and certainly can’t deal with the cost of LLMs..) this applies all the way from internal company transaction processing systems to Home Assistant dashboards.
So we have those magical things able to conjure up generally working code, Codex/Claude/OpenCode/Pi/etc. etc. but how do you deploy 100 mini apps and manage dependencies between each one? I have a pretty bigly Proxmox cluster with 416 vcpus and terabytes of ram, but I’m not going to put each 1k-10k LOC slop app in its own CT/VM. Kubernetes? Eh maaybe, but try to manage a massive mesh of 100s of dependant apps. It’s possible but you’re now a full time k8s admin for what should have been a fairly simple homelab, and you still have multi-minute iteration cycles.
What I really wanted is something that:
Important caveat: this is not a general sandbox you can e.g. do your programming work for a job, that was a non-goal, the goal was enabling custom workflows that, in a company, would be managed by an IT department in an in-house datacenter.
This is how https://xbin.dev/ came to be. It may or may not be the solution to the self-modifying sandboxes feeling like toys, maybe yall like it.
What I’ve used it for successfully so far:
What you may notice is that everything generally falls into either ‘somewhat sensitive‘ and ‘really sensitive‘ categories. Normally you wouldn’t let AI agents, even local ones near this stuff - the way I’ve addressed that is by having ‘code’ and ‘runtime‘ sandboxes be 100% separate and just having the coding agent see a proxied (and disconnectable) API access to the app backend its writing. Each app has a sandboxed encrypted filesystem (if they request that, by default app filesystem view is fully read-only; fs encryption is done through a built-in in-memory vault system), apps must explicitly request grants for everything including internet access, access to other app APIs etc; Networking itself is also pretty interesting because by default you can filter apps to only allow egress to internet (gvisor userspace proxy) meaning rouge apps can’t scan your LAN/host. Also you can create apps which provide networking to other apps, meaning you can create VPN/Proxy/traffic analysis apps for whatever you’d need those for.
This got long..