AI Agent Sandboxing with Nono

**Bret Fisher** (0:00)
this episode couldn't be more timely because it just days ago, like maybe two, two days after this episode was recorded, we heard about the HuggingFace hack by OpenAI on both ends of the spectrum, we're gonna need some sandboxing and locking of this stuff down.
This episode is about agent sandboxes, or just sandboxing, sandboxing anything. Hell, we've for 30 years have had sandboxing technologies that we could label as a sandbox-type thing with jails and Chroot and Docker and VMs. Like these are all isolation technologies, namespaces, cgroups, you name it. There's been a dozen or more attempts over the last 30 years, and now we are focused on agents and AI running amok on our local systems, but that's not enough. This is about sandboxing, specifically with nono. You can find it at nono.sh. It's by nolabs, and I had the founder, Luke Hinds on the show, where we went long on this one, and that's because there's a part of it where we talk about nono, how it works. It's a command line that you can wrap any binary on Mac or Linux. On Windows, you would use WSL2 to run nono. But it runs against the kernel primitives. So unlike many other ideas around isolation technology that use VMs or containers or both, this is focused on just using the native functionality of the kernel and giving you a profile for each thing you wanna run in it, You can use it for everything. You can use it for kubectl. You can use it for GitHub command line. You can use it to run lots of other interesting things on your computer. It can even work with GUIs potentially, as long as you can handle the sophisticated approach that a GUI requires in terms of file access and all that stuff. I'm very, very interested in sandboxing technology. Docker is one of the major players here. They have the, the Sandbox or SBX command, which is a VM that runs Docker inside it, that then runs the agent harness inside that. And nono tries to take a much more direct approach by using the kernel primitives that are already there, and it's built by some really smart people that built Sigstore, So there's all sorts of stuff that we dabble in, but this show, I think, will be essential learning for everyone using agent harnesses, which is essentially every developer and DevOps and platform engineer on the planet, because of one reason As we get tasked to use cheaper models, the hallucinations will increase. And in fact, a cheaper model doesn't mean that hallucinations are more likely, but we are gonna all probably at some point need to push the envelope for how cheap can we get it. In fact, I know teams that their egos reside on how little they spend on tokens by using cheaper and cheaper models, using Haikus, using the GLMs and the Kimis. And these models may or may not be more likely to hallucinate. But as you push that envelope to how cheap you can get in a model, how old of a model can you get, or how cheap or of a smaller a model can you get to run some of your workloads and some of your automations in CI, you're gonna potentially deal with more hallucinations. So we've got it on both ends of the cheaper models are what we need, but that may mean more hallucinations, which may mean you need to care about locking your stuff down, or the models are gonna be so sophisticated that they might actually go a little more rogue in just the service of doing what you asked it to do.
And if you leave them alone long enough, they may actually do something bad in search of doing the good thing. And so they're not necessarily nefarious, That's what happened with HuggingFace, was it was just trying to solve a test. It was trying to prove that it was intelligent, so it went crazy and wouldn't quit.
And the sandboxing is an area where we've got lots of different options, and I like nono for its simplicity and its ease of use in my day-to-day, and I'm now very interested in how can I use it in my CI and other places as well to sort of have a blanket approach. And we talk about a lot of those ideas in this podcast, so let's get to it Bret (2): Welcome to the show. We've got Luke Hinds here, the s- co-founder and CEO of nolabs.

**Luke Hinds** (3:59)
Thank you so much for having me. Enjoying this Bret (2): So just a real quick background on Luke here, 'cause he's a humble guy. He's probably not gonna tell you. He's kind of a big deal. He created Sigstore, which one of my favorite security projects. Sigstore is very popular. If you don't know Sigstore, if you don't know you don't know, go check it out. it's there to help secure your code essentially and give you some, some assurances. OpenSSF, which I'm also a very big fan of, and we talked about at least multiple times a year on this channel. You were a board member? I didn't know that. That's very cool.