skills.rest
brucebanner010198-commits
brucebanner010198-commitsCOMMUNITY
Explore all skills by this author →
GitHub

container-isolation-posture

Standardize nine-rule secure sandbox isolation design for LLM-driven agent execution surfaces.

Updated Apr 21, 2026
Search Tags:#design#security#compliance#policy#sandbox#container-isolation
One-click install
npx skills add https://github.com/brucebanner010198-commits/DevSecOps-Agency --skill container-isolation-posture
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: container-isolation-posture
Source: https://github.com/brucebanner010198-commits/DevSecOps-Agency/tree/main/skills/container-isolation-posture
Command: npx skills add https://github.com/brucebanner010198-commits/DevSecOps-Agency --skill container-isolation-posture

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill codifies a nine-rule posture to ensure safe and isolated execution of LLM-driven agents on host resources, addressing risks from sandbox escapes, data leakage, and policy violations.

Core Features & Use Cases

  • Nine-rule posture: external allowlists, fail-closed defaults, symlink resolution, container-path validation, read-only project roots, per-tenant session isolation, and credential vault guidance.
  • Policy-first design guidance: applies to laptops, CI runners, containers, or VMs; pairs with sandbox and consumer-side defenses (mcp-defense, secrets-vault, etc).
  • Use cases: designing secure sandboxes for agent execution, auditing existing runtimes, and reviewing MCP surfaces for isolation.

Quick Start

Apply this posture when reviewing or designing an agent execution surface to ensure container isolation is enforced across the host.

Frequently Asked Questions about container-isolation-posture

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is sandbox isolation for LLM agents and why do I need a posture?▼

Sandbox isolation for LLM agents prevents escapes, data leakage, and policy violations on host resources. A standardized posture ensures secure execution by enforcing external allowlists, fail-closed defaults, and per-tenant session state across runtimes.

How do I design a secure container isolation strategy for agent execution surfaces?▼

Design secure container isolation by applying a nine-rule posture: enforce external allowlists, fail-closed defaults, symlink resolution, container-path validation, read-only project roots, per-tenant session isolation, and credential vault guidance.

Can I use this sandbox isolation posture on CI runners and virtual machines?▼

Yes, this policy-first posture applies to laptops, CI runners, container runtimes, and virtual machines. It supports designing, reviewing, and auditing agent-execution surfaces across these environments.

What are the fail-closed defaults and container-path validation rules for sandbox design?▼

Fail-closed defaults block execution if policies are unmet, while container-path validation ensures agents only access authorized paths. These rules standardize runtime boundaries and prevent unauthorized host file access.

How do I audit an existing container runtime for LLM sandbox isolation compliance?▼

Audit container runtimes by checking the nine-rule posture: verify symlink resolution, read-only project roots, per-tenant session state, IPC authorization, and credential vault guidance to ensure isolation controls are enforced.

What's the best way to handle credential vault guidance and IPC authorization in agent sandboxes?▼

Handle credentials and IPC by integrating consumer-side defenses like secrets-vault and mcp-defense. The posture requires explicit IPC authorization and credential vault guidance to isolate tenant sessions and protect secrets.

Related Skills

Explore More Software Engineering Skills→
danielraffeldanielraffel
1

tart-ci

Set up a cached, isolated macOS CI lane with Tart VMs and ephemeral GitHub Actions runners.

Community
Advanced
Hawksight-AIHawksight-AI
2.9k

policy

Manage and validate policy rules for knowledge graph compliance.

Official
Intermediate
BartunekBartunek

init-onecli

Migrate .env credentials into the OneCLI Agent Vault.

Community
Advanced
rajitsaharajitsaha
10

cloud-security

Audit GCP infrastructure for IAM, firewall, storage, and container misconfigurations.

Community
Advanced