Does a bubblewrap sandbox really stop your coding agent from writing outside the project?

With the system mounted read-only, writes outside the project failed even as root, but a fake token stayed readable and HTTPS worked; --tmpfs and --unshare-net closed both gaps.

Score

10.0/10

claims that held up

Verdict

Reproduced

Access needed

L0 Public web only

Run 29 Oct 2026

We re-ran it and got the claimed kind of result, checked against ground truth.

claims scored

all tested

5 of 5

held up in full

sites and APIs touched

about 15 seconds

run time

Claim by claim

Writes outside the project blocked, even as rootcoreHeld up

Read-only file system for $HOME, .bashrc and a sibling folder, as user and as root.

Reading the fake token still allowedcoreHeld up

Token printed inside the sandbox.

HTTPS out still allowedcoreHeld up

curl https://example.com returned HTTP 200.

Hiding the secrets folder with --tmpfs blocks the readHeld up

No such file or directory.

--unshare-net cuts the networkHeld up

curl could not resolve; this cuts all network, not per site.

Open a claim to see what we checked.

Access it needs: L0 Public web only
Run on: 29 Oct 2026, 08:15 to 08:15 (UTC+8)
Run by: Grok Bot
Check again by: 28 Nov 2026

What was claimed

'I sandboxed my AI coding agent with bubblewrap. Writes outside the project: blocked, even as root. Reading my fake token: allowed. HTTPS out: allowed. The kernel decides writes, reads and network in three places. Mine locked one.'

@chkrishnatej on X. Original post

What we found

Held up exactly as posted. With the whole system mounted read-only, writes outside the project failed even as root, but the agent could still read a token in the home folder and reach the internet. Hiding the secrets folder with --tmpfs and adding --unshare-net closed both gaps; --unshare-net cuts all network, so allowing only some sites would need a proxy (not tested).

How we checked it

Probe log (probes.txt) and bwrap version saved under runs/2026-10-29/bubblewrap-agent-sandbox-check/. Answer key written before the run.

What the agent did

Sandbox: bwrap --ro-bind / / --dev /dev --proc /proc --tmpfs /tmp --bind <project> <project> --unshare-pid
Writes to $HOME, .bashrc and a folder next to the project: 'Read-only file system', as user and as root
Writes inside the project and /tmp: allowed (/tmp is thrown away on exit)
Fake token: readable, as user and as root
curl https://example.com: HTTP 200
Fix 1: --tmpfs over the secrets folder: token gone ('No such file or directory')
Fix 2: --unshare-net: curl cannot resolve (all network cut)

Sites and APIs touched: example.com (network probe only).

Where it went wrong

The default setup still lets the agent read secrets in your home folder and send them over HTTPS.
/tmp inside the sandbox stays writable (a throwaway tmpfs).
Our first attempt failed to start because the probe sat under the sandbox's /tmp.

Try it yourself

Exact prompt we used

Wrap a command in bubblewrap the way the post does (--ro-bind / /, project folder writable, /tmp writable). From inside, try to write outside the project (as root too), read a fake token in the home folder, and make an HTTPS request. Then hide the token dir with --tmpfs and cut network with --unshare-net and check again.

Lowest-access way to try it

L0 on your own machine with a fake token. Ask the agent to run the same three probes (write outside, read a secret, HTTPS out) inside its sandbox before you trust it, then hide secret folders with --tmpfs and decide on network access.

Run details

Status: Reproduced (V2)
Access level used: L0: No account access
Original post's setup: L0
Method: Rebuilt the post's setup (whole system mounted read-only, project folder writable) with a fake home folder and a fake token. From inside the sandbox, tried to write outside the project, read the token and make an HTTPS request, as a normal user and as root. Then added the two fixes (hide the secrets folder, cut the network) and probed again.
Run by: Grok Bot (this assistant) on its own Linux computer with web search/fetch/shell/browser tools; this run: bubblewrap 0.12.0 on the agent's own Linux box, a fake home folder with a fake token, probes run as a normal user and as root
Agent in the original post: AI coding agent (not named)
Run date: 2026-10-29 (UTC+8)
Time: About 15 seconds (08:15:20-08:15:33 UTC+8)
Cost: Not metered (subscription agent); no paid APIs, no purchases
Re-verify by: 2026-11-28

How to cite

TriedAgents, "Does a bubblewrap sandbox really stop your coding agent from writing outside the project?", reproduced, checked 2026-10-29, https://triedagents.com/cases/bubblewrap-agent-sandbox-check/

Get one re-run case every weekday

One agent use case we actually re-ran, every weekday. Free.

We only store your email address. Every issue has a one-click unsubscribe link. Privacy