akitaonrails/ai-jail

ai-jail is a command-line tool that launches AI coding agents (Claude, Codex, Codex-style harnesses, etc.) inside an OS-level sandbox. Its purpose is narrow and honest: it does not defend against a malicious attacker trying to escape — only against a capable-but-fallible AI agent making honest mistakes, like running a mistyped command that wipes files outside the project.

How it protects you

The agent gets a fresh, disposable home directory (tmpfs) instead of your real $HOME, while the project directory you're working in stays readable and writable. Everything else on the host is hidden unless you explicitly expose it. On Linux it uses bubblewrap plus Landlock (filesystem access control) and seccomp (system-call filtering); on macOS it uses Apple's sandbox-exec.

What's on by default (developer-friendly, not lockdown)

• The agent's own credential directory (~/.claude, ~/.codex, etc.) is mounted read-write, so it starts pre-authenticated instead of asking you to log in every session. You can opt out with --no-agent-state.
• Persistent, jail-owned dependency caches (cargo, npm, go, etc.) plus read-only Rust toolchain, so npm install / cargo build work out of the box without exposing your real toolchain.
• Filtered network egress to package registries only, so dependency downloads succeed.

What's off by default

Network, GPU, KVM, display, audio, Docker socket, SSH keys, Tailscale, and cloud credentials (GitHub/AWS/kube/gcloud/docker) — each is an explicit opt-in flag with a documented risk, because anything running in the sandbox can use whatever you mount.

Notable features

• --lockdown: the strictest mode — read-only project, no credentials, no network, strict seccomp. Still not a VM.
• --allow-host HOST: filtered egress via an in-sandbox proxy that only dials the listed hosts; combined with --secret KEY=host, the real API key never enters the sandbox — a placeholder is swapped for the real value only for requests to that host.
• --dry-run: simulate a launch without writing anything.
• Writability scoping: the project directory is the blast radius, so users can safely enable "auto-accept" (YOLO) mode in agent harnesses.

Install/usage: Homebrew, Arch (AUR), cargo install, Nix flakes, or GitHub releases. Usage is simply ai-jail claude (or codex, etc.) from inside a project directory. Linux requires bubblewrap; macOS uses the deprecated sandbox-exec; Windows via WSL2 only.

Bottom line: A practical accident-prevention layer for running LLM-based coding agents locally — not a security boundary. Clearly scoped, thoughtfully designed, and unusually candid about its threat model.