Overview of solon-ai-sandbox
mainsolon-ai-sandbox
solon-ai-sandbox is the security isolation module within the Solon AI ecosystem. It provides cross-platform (macOS, Linux, Windows) isolation for file systems, networks, and processes specifically designed for executing AI Agent code safely.
It is a Java port of Claude Code's sandbox-runtime (originally TypeScript) and provides an embeddable sandbox runtime.
Core Capabilities
- File System Isolation: Uses
deny-then-allow-back(for reading) andallow-only(for writing) strategies to precisely control process access. - Network Isolation: Built-in HTTP/SOCKS5 forward proxies with support for domain allow/deny lists and real-time dynamic rule updates.
- Cross-Platform Support:
- macOS: Uses
sandbox-exec+ Seatbelt configurations. - Linux: Uses
bubblewrap (bwrap)+seccomp. - Windows: Uses
srt-win.exe+ WFP.
- macOS: Uses
- Interactive Authorization: Provides the
SandboxAskCallbackinterface to prompt users when a network request does not match existing rules. - Violation Tracking:
SandboxViolationStorethread-safely records all sandbox violations, supporting category-based filtering. - Parent Proxy Support: Supports upstream HTTP/HTTPS proxies (via
HTTP_PROXYetc.) andNO_PROXYCIDR/domain matching. - Real-time Configuration Updates: Network allow-lists support hot-updates without restarting the proxy server.