astrid-runtime/astrid

Astrid is a portable, capability-secure operating system for composable software.

What it solves

Astrid addresses the security risks inherent in AI agent frameworks that rely on prompts for safety. Instead of trusting a model to behave, Astrid provides an OS-grade security boundary that separates the model's decision-making from the authority to execute actions, ensuring that untrusted code cannot access files, networks, or credentials without explicit, cryptographic permission.

How it works

Astrid operates as a user-space runtime (with the goal of becoming a standalone OS) that runs software as WebAssembly (WASM) "capsules." These capsules are sandboxed using Wasmtime and have no ambient authority, meaning they cannot make syscalls or access host memory directly.

Communication and authority are managed through:

  • The Kernel: A "dumb" event router that manages an event bus, enforces a capability-based Access Control List (ACL), and maintains a signed audit chain.
  • Capabilities: Access to resources (files, network hosts) is granted via signed ed25519 tokens that are principal-bound and revocable.
  • IPC Bus: Capsules communicate via typed interfaces (WIT ABI) and an event bus rather than direct function calls.
  • Per-Principal Isolation: Every identity (principal) has its own isolated storage, secrets, and capsule access.

Who it’s for

Astrid is designed for developers building agent systems, tools, and services who require high-security isolation and explicit authority management, as well as those wanting to build their own software distributions based on WASM components.

Highlights

  • Cryptographic Capability Model: Every resource access is a signed grant, not a prompt instruction.
  • WASM Sandboxing: Capsules run with zero ambient authority, preventing unauthorized host access.
  • Hot-Loading: Capsules can be installed, upgraded, or removed while the runtime is running without requiring a restart.
  • Durable State: Content-addressed storage with native mounts for macOS (FSKit) and Linux (FUSE).
  • Auditability: A signed, hash-linked audit chain records all decisions and calls for independent verification.

Related

  • Project
    opensandbox-group/OpenSandbox

    OpenSandbox is an open‑source sandbox platform for AI agents and other code‑execution workloads. It offers multi‑language SDKs, a CLI, and a server that can run sandboxes on Docker locally or on Kubernetes at scale, with strong isolation (gVisor, Kata, Firecracker), network policies, and a credential vault. Use cases include coding agents, browser/desktop automation, RL training, and secure code‑execution services.

  • Project
    microsoft/wassette

    A security-oriented runtime that allows AI agents to execute WebAssembly Components as tools via the Model Context Protocol (MCP).

  • Project
    anthropics/sandbox-runtime

    A lightweight OS-level sandboxing tool that enforces filesystem and network restrictions on processes to enable safer AI agents and MCP servers.

  • Dispatch
    Docker Sandboxes for AI Agents

    Docker Sandboxes provide isolated microVM environments for AI coding agents to execute commands and install packages safely without risking the host system.

  • Dispatch
    Securing AI Agents with Isolated Docker Sandboxes

    An exploration of agent-sandbox, a tool designed to run AI coding agents within isolated Docker containers to prevent unauthorized system access and ensure execution safety.