# Sandbox Hardening Checklist for Code-Executing Agents

> A three-step checklist to isolate and harden runtimes for arbitrary code execution.

This architectural tip covers three practical steps to protect agent runtimes before executing untrusted code. Adapted from Browser Use's sandbox engineering patterns, it focuses on stripping source files, dropping system privileges, and cleaning runtime environments to prevent token leakage and privilege escalation.

## How it works

1. Bytecode-only execution: compile Python to .pyc in Docker build, delete every .py; framework loads into memory as root, source gone. 2. Privilege drop: start as root only to read root-owned bytecode, then setuid/setgid to a 'sandbox' user. 3. Environment stripping: read SESSION\_TOKEN, CONTROL\_PLANE\_URL, SESSION\_ID into Python variables, then delete from os.environ; VM in private VPC with only control-plane access.

## What it is for

- Harden containerized environments before running untrusted LLM-generated code
- Prevent environment variable scraping in multi-tenant agent execution runtimes
- Reduce attack surface by dropping root permissions and removing source code files

## Key points

- Bytecode-only execution by compiling Python files to .pyc during build and removing .py sources
- In-memory loading as root before executing untrusted code
- Privilege dropping via setuid and setgid to an unprivileged sandbox user
- Environment variable stripping to remove sensitive tokens and URLs from os.environ after ingestion
- Network confinement to private VPCs restricted to control plane communication

## Pricing

Free

## Details

- Type: Tip
- Category: [Development](https://xiry.app/topics/development.md)
- Platforms: Linux, Self-hosted
- For: Security engineers and AI developers building code-execution sandboxes
- Tags: sandboxing, security, ai agents, docker, python

## Why it was saved

- [@larsencc, 27 February 2026](https://x.com/larsencc/status/2027225210412470668): Reusable security checklist for anyone running agent code in containers/VMs.

## Related

- [Browser Use Agent Sandbox Architecture](https://xiry.app/resources/browser-use-agent-sandbox-architecture): Architecture pattern for securely running code-executing agents inside isolated micro-VMs (Framework, Free)
- [awesome-llm-apps](https://xiry.app/resources/awesome-llm-apps): Open-source collection of runnable AI agent, skill, and RAG templates (GitHub repo, Open source)
- [smolagents](https://xiry.app/resources/smolagents): Lightweight open-source Python library for building code-writing and vision AI agents (Web app, Open source)
- [agent-browser Environments](https://xiry.app/resources/agent-browser-environments): Run browser automation agents inside on-demand isolated sandbox environments (Web app, Free)
- [boat](https://xiry.app/resources/boat): Persistent Ubuntu cloud sandboxes with browsers for running AI agents (Web app, Freemium)
- [Composio](https://xiry.app/resources/composio): Tooling and authentication layer connecting AI agents to external applications (GitHub repo, Freemium)

Updated 11 October 2026. Page: https://xiry.app/resources/sandbox-hardening-checklist-for-code-executing-agents

Make your own library: Xiry takes your saved reels, tweets, Reddit bookmarks and Watch Later videos, makes them searchable and pulls the useful stuff out, like this library. It's invite-only for now; join the waitlist at https://xiry.app/#waitlist.