Support running agents in sandboxes?

[vladdu]

Maybe there is already support for sandboxing and I didn't find it, but I think it would be great if one didn't had to worry about agents running amok on one's computer. There are several sandbox solutions, I like https://enclave.eclipse.dev/ personally. Is there any chance this could make it on the list of planned features?

Great project, by the way!

[michael-dg]

Very interested in this too — I run my agents in Docker Sandboxes (sbx) and built a small launcher around it. A minimal way in might be a per-project launch wrapper: a configurable command that prefixes the harness invocation (sbx run …, an enclave, a container), so nebula doesn't need to know about any specific sandbox. I'd like to contribute this if the direction fits.

[vladdu]

I'd like to hear from others that might have more experience, but maybe it's better to do it the other way around, that is to run nebula inside an enclave container. Yes, all agents will share the sandbox, but that's not a huge issue. One can't switch tools, but maybe that's not a big problem either, in most cases.