Skip to content

Instantly share code, notes, and snippets.

View sthulb's full-sized avatar

Simon Thulbourn sthulb

126 followers · 28 following
View GitHub Profile
@wincent
wincent / agent-sandboxen.md
Last active November 10, 2026 13:48
List of coding agent sandboxes 2026-05

Coding Agent Sandboxes — Comprehensive List

Compiled from awesome-lists (restyler/awesome-sandbox, webcoyote/awesome-AI-sandbox, bureado/awesome-agent-runtime-security) and a survey of vendor blogs / field guides published through 2026. Grouped by isolation primitive and then by deployment model.

1. OS-level primitives (no container, no VM)

These rely on kernel/userland features to constrain a normal host process. Lowest overhead, weakest boundary.

  • macOS Seatbelt / sandbox-exec — Apple's TrustedBSD-based MAC framework. Used directly by Codex CLI, Gemini CLI, and underneath Anthropic's srt.
  • Linux Landlock — Unprivileged filesystem/network LSM; default backend for Codex CLI on Linux.
@arianvp
arianvp / SSH_MACOS_SECURE_ENCLAVES.md
Last active November 11, 2026 15:59
Native Secure Enclaved backed ssh keys on MacOS

Native Secure Enclave backed ssh keys on MacOS

It turns out that MacOS Tahoe can generate and use secure-enclave backed SSH keys! This replaces projects like https://github.com/maxgoedjen/secretive

There is a shared library /usr/lib/ssh-keychain.dylib that traditionally has been used to add smartcard support to ssh by implementing PKCS11Provider interface. However since recently it also implements SecurityKeyProivder which supports loading keys directly from the secure enclave! SecurityKeyProvider is what is normally used to talk to FIDO2 devices (e.g. libfido2 can be used to talk to your Yubikey). However you can now use it to talk to your Secure Enclave instead!