AgentBox Sandbox Architecture

AgentBox Sandbox Architecture A architecture diagram generated by Archify. Podman Container (bridge network) Nested Network Namespace goose-sandbox · @gs CLI · Architecture component goose-sandbox @gs CLI OpenShell Gateway · gRPC control plane · Architecture component OpenShell Gateway gRPC control plane Supervisor · PID 1 · UID 0 · Podman Container (bridge network) · Landlock + seccomp Supervisor PID 1 · UID 0 Landlock + seccomp Agent Namespace · veth1 10.200.0.2 · Podman Container (bridge network) › Nested Network Namespace · UID 1000 Agent Namespace veth1 10.200.0.2 UID 1000 Goose CLI · run / session · Podman Container (bridge network) › Nested Network Namespace Goose CLI run / session CONNECT Proxy · veth0 10.200.0.1 · Podman Container (bridge network) CONNECT Proxy veth0 10.200.0.1 OPA Policy · deny-by-default · Podman Container (bridge network) OPA Policy deny-by-default Goose Binary · ~/.local/bin/goose · Architecture component Goose Binary ~/.local/bin/goose Goose Config · ~/.config/goose · Architecture component Goose Config ~/.config/goose AgentFS · ~/.agents · Architecture component AgentFS ~/.agents Project Dir · read-write · Architecture component Project Dir read-write LiteLLM Proxy · :4000 on host · Architecture component LiteLLM Proxy :4000 on host LLM Provider · upstream API · Architecture component LLM Provider upstream API gRPC/mTLS create/exec spawn exec HTTP_PROXY policy check allowed API call bind-ro bind-ro bind-ro bind-rw Legend Frontend Backend Cloud Security External

Isolation Layers

  • • Landlock LSM — irrevocable filesystem confinement
  • • OPA/Rego — deny-by-default network policy
  • • seccomp BPF — syscall filtering

Bind Mounts

  • • Binary + config + AgentFS: read-only
  • • Project directory: read-write
  • • No image rebuild on Goose update

Network Path

  • • Agent → CONNECT proxy → OPA → host endpoint
  • • host.containers.internal dual-resolution
  • • Only declared endpoints reachable