Hacker News: _ananos_

Kata Containers 4.0.0 Brings You a New Rust Runtime

_ananos_ — Wed, 22 Jul 2026 16:47:30 +0000

Article URL: https://katacontainers.io/blog/kata-containers-4-0-0-release-overview/

Comments URL: https://news.ycombinator.com/item?id=49009667

Points: 3

# Comments: 0

New comment by _ananos_ in "The Sandboxing Manifesto for Agentic Execution"

_ananos_ — Tue, 21 Jul 2026 21:04:54 +0000

@bugsense Agreed on OS-level sandboxing -- the paper actually argues it is not a sandbox at all. If the host kernel is in the trust path, you have a weaker boundary, and it does nothing for the credential problem either. Our definition starts at hardware-level isolation: the agent runs in a microVM, and everything it can touch crosses a host-mediated virtio boundary.

That boundary is where the credential story changes. The token, the policy engine, and the audit log live on the host side, where the agent cannot reach them. Guardrails inside the agent context (an app-layer "are you sure" wrapper, a system prompt) share the cage with the agent -- a prompt injection can talk its way around them. Guardrails on the trust boundary cannot be talked to at all. The sandbox does not decide whether a granted API call is being abused; it guarantees the thing that decides is out of the agent's reach.

To your actual question: we do neither extreme. Capabilities are deny-by-default and granted per investigation, scoped to endpoints, not "the network". Read paths flow freely -- that is most of an investigation anyway. Mutating calls are a small set, and remediation is proposed, not executed: the mutation goes through an approval step at the boundary. So yes, human gating for mutations. It stays practical because the mutating surface is small by construction.

On shadow environments: honestly, you mostly cannot mirror domain state. You cannot fork Stripe, or a customer's prod cluster, and diff the side effects. Where the substrate supports it we use dry-run / plan-apply, and the microVMs are checkpointed per step, so the agent's own state can be rewound cheaply. An external side effect, once committed, is the one thing no sandbox rewinds. Which is exactly why we keep that set small and gated at the boundary.

New comment by _ananos_ in "[dead]"

_ananos_ — Tue, 21 Jul 2026 17:24:01 +0000

Sandboxing for Agentic Execution: A whitepaper with our take on the definition of Sandboxing!

New comment by _ananos_ in "ITScape (CVE-2026-46316): KVM/ARM64 VM escape"

_ananos_ — Fri, 12 Jun 2026 12:54:06 +0000

CVE-2026-46316 ("ITScape"). Reported by Hyunwoo Kim (@v4bel). This post discusses the vulnerability and its mitigations at a conceptual level using already-public information: no gadget offsets, no heap-spray primitives beyond what the author's own write-up discloses.

ITScape (CVE-2026-46316): KVM/ARM64 VM escape

_ananos_ — Fri, 12 Jun 2026 12:54:06 +0000

Article URL: https://www.nofire.ai/blog/ITS-arm64-escape

Comments URL: https://news.ycombinator.com/item?id=48503521

Points: 8

# Comments: 1

New comment by _ananos_ in "How many sandboxed pods can fit in a Pi?"

_ananos_ — Wed, 20 May 2026 11:18:35 +0000

thanks @anenefan -- we'll have to figure out what's wrong with our SEO I guess..

New comment by _ananos_ in "Ask HN: Second time my post gets [dead] within a minute"

_ananos_ — Wed, 20 May 2026 11:07:35 +0000

no ads on the website.

Ask HN: Second time my post gets [dead] within a minute

_ananos_ — Wed, 20 May 2026 11:04:33 +0000

I'm trying to understand what we're doing wrong and our posts become auto-[dead].

'How many sandboxed pods can fit in a Pi? (nubificus.co.uk)'

Given prior responses here, the only thing that would flag that is that I'm posting links from our blog (which tbh sounds legit to me... as I'm trying to share our work).

Comments URL: https://news.ycombinator.com/item?id=48205837

Points: 2

# Comments: 4

How many sandboxed pods can fit in a Pi?

_ananos_ — Wed, 20 May 2026 10:56:16 +0000

Article URL: https://nubificus.co.uk/blog/runtime_benchmarking_rpi/

Comments URL: https://news.ycombinator.com/item?id=48205767

Points: 11

# Comments: 2

New comment by _ananos_ in "Gvisor on Raspbian"

_ananos_ — Fri, 13 Mar 2026 22:44:11 +0000

wasn't familiar with proot -- with a quick look I think proot is a fancy chroot -- which, in turn, is kind of "the first step" for a generic container.

to achieve the isolation that gvisor offers you would have to intercept syscalls, create a separate mount/user/net namespace etc.

regardless, I don't think proot is somehow related to gvisor ;)

New comment by _ananos_ in "Gvisor on Raspbian"

_ananos_ — Fri, 13 Mar 2026 21:44:57 +0000

a number of reasons -- power budget, form factor, experimenting as a testbed for more "elaborate" setups (like robotics combined with a low-end TPU like the coral, or a jetson nano)

consider that you can take advantage of all the cloud-native goodies, all wrapped up in a 10x5 box with 5-10W (or 25-30W if you consider jetson boards).

New comment by _ananos_ in "Gvisor on Raspbian"

_ananos_ — Fri, 13 Mar 2026 20:13:07 +0000

well, jokes aside, what you're describing, is kind of what a "secure" (with many air/literal quotes) MCP/Agentic architecture looks like :D

In this context we're experimenting with gvisor on various platforms, and we're preparing a demo for kubecon about a fine-grained sandboxing approach for AI agent tasks spawned from a sandboxed agent.

New comment by _ananos_ in "Gvisor on Raspbian"

_ananos_ — Fri, 13 Mar 2026 18:56:53 +0000

yeap -- compute would be nearly the same. I suspect you need some kind of I/O to make your compute useful (get input for the computation / produce output etc.) so, still, this would have a negative effect overall.

New comment by _ananos_ in "Gvisor on Raspbian"

_ananos_ — Fri, 13 Mar 2026 15:16:51 +0000

the simplest one (and the one we're targetting) is multi-tenant services. You want to sandbox your service so that it doesn't affect the rest of the services running.

We're building a container runtime to do this, and we are comparing alternatives, that's how we got there: https://github.com/urunc-dev/urunc

New comment by _ananos_ in "Gvisor on Raspbian"

_ananos_ — Fri, 13 Mar 2026 13:13:46 +0000

well, the tricky detail here (which we do not mention in the post, our bad) is that we got the raspbian config (cp /boot/config ... .config && make oldconfig) which includes most modules, and that's why it took more.

But yeap, good point about using the -j flag, it really accelerates the build!

New comment by _ananos_ in "Ask HN: Uploaded a post and it was [dead] within a minute"

_ananos_ — Fri, 13 Mar 2026 11:53:15 +0000

thanks, good to know!

New comment by _ananos_ in "Ask HN: Uploaded a post and it was [dead] within a minute"

_ananos_ — Fri, 13 Mar 2026 10:55:09 +0000

indeed! thanks for that. Could it be a malformed SEO/robots whatever these things are called from our website?

New comment by _ananos_ in "Ask HN: Uploaded a post and it was [dead] within a minute"

_ananos_ — Fri, 13 Mar 2026 10:35:32 +0000

thanks for your comment & suggestion!

I'll drop the HN admins an email to make sure I'm not missing anything.

Ask HN: Uploaded a post and it was [dead] within a minute

_ananos_ — Fri, 13 Mar 2026 10:25:25 +0000

Just published a blog post -- when I am logged in I get the entry appearing in the section, but when I log out, I don't see it at all -- I asked a colleague to check, and it seems it got flagged as [dead]. Can you help me understand what was wrong so that it doesn't happen again?