Container Sandbox

Overview

Loop includes deep container sandboxing powered by Podman. Run AI-generated shell commands and code in isolated containers — protecting your host system from unintended side effects.

Sandbox Modes

Mode	Description
Off (default)	Commands run directly on the host
Local (partial)	Host filesystem access (path-jailed); only `bash` runs in the container
Local (full)	All tools execute inside the container via `podman exec`

Quick Setup

Prerequisites

Install Podman:

macOS
Linux

brew install podman
podman machine init
podman machine start

# Ubuntu/Debian
sudo apt install podman

# Fedora
sudo dnf install podman

Enable Sandbox

In the TUI:

/sandbox local

Or with specific options:

/sandbox local --full --runsc

--gvisor is an alias for --runsc. /sandbox local with no flags is full isolation on runc.

Check Status

/sandbox status

Isolation Levels

Partial Isolation

/sandbox local --partial

Host filesystem is accessible but path-jailed to your working directory
Only bash tool runs inside the container
read, write, and edit operate on the host filesystem
Good balance of safety and convenience

Full Isolation

/sandbox local --full

All tools execute inside the container
File operations go through podman exec
Your working directory is bind-mounted at the same absolute path inside the container
Maximum isolation from the host system

Container Runtimes

Loop supports multiple OCI runtimes for different security profiles:

Runtime	Flag	Description
runc (default)	`--runc`	Standard Linux container runtime
crun	`--crun`	Lightweight C-based runtime
runsc (gVisor)	`--runsc` or `--gvisor`	Application kernel for enhanced isolation
krun	`--krun`	microVM-based isolation using libkrun

# Use gVisor for enhanced security
/sandbox local --full --gvisor

# Use microVM isolation
/sandbox local --full --krun

gVisor (runsc) and krun must be installed separately. See their respective documentation for installation instructions.

Configuration

Settings File

Configure sandbox defaults in ~/.loop/agent/settings.json:

{
  "sandbox": {
    "mode": "local",
    "isolation": "full",
    "runtime": "runsc"
  }
}

Per-Project Override

In .loop/settings.json (requires project trust):

{
  "sandbox": {
    "mode": "local",
    "isolation": "partial",
    "runtime": "runc"
  }
}

Command Safety

Even without the container sandbox, Loop includes a built-in command blocklist that prevents dangerous commands:

rm -rf /
Fork bombs
Disk wipe patterns (dd if=/dev/zero)
Other destructive operations

The blocklist is applied via check_command_policy before any command executes, regardless of sandbox mode.

How It Works

┌─────────────────────────────────────┐
│  Loop Agent                         │
│  ┌─────────────┐                    │
│  │ bash tool   │──→ check_command_policy
│  └─────────────┘         │          │
│                    ┌─────▼─────┐    │
│                    │ Sandbox?  │    │
│                    └─────┬─────┘    │
│              ┌───────────┼──────┐   │
│              ▼           ▼      ▼   │
│           Host       Partial   Full │
│           shell      (bash     (all │
│                      only)     tools)│
│                        │        │   │
│                    ┌───▼────────▼─┐ │
│                    │   Podman     │ │
│                    │  container   │ │
│                    └──────────────┘ │
└─────────────────────────────────────┘

The SandboxFactory and SandboxRegistry provide pluggable sandbox implementations, allowing custom sandbox backends to be registered.

Disabling the Sandbox

/sandbox off

Or in settings:

{
  "sandbox": {
    "mode": "off"
  }
}

Getting Started

Guides

Features

Container Sandbox

Overview

Sandbox Modes

Quick Setup

Prerequisites

Enable Sandbox

Check Status

Isolation Levels

Partial Isolation

Full Isolation

Container Runtimes

Configuration

Settings File

Per-Project Override

Command Safety

How It Works

Disabling the Sandbox

​Overview

​Sandbox Modes

​Quick Setup

​Prerequisites

​Enable Sandbox

​Check Status

​Isolation Levels

​Partial Isolation

​Full Isolation

​Container Runtimes

​Configuration

​Settings File

​Per-Project Override

​Command Safety

​How It Works

​Disabling the Sandbox

Overview

Sandbox Modes

Quick Setup

Prerequisites

Enable Sandbox

Check Status

Isolation Levels

Partial Isolation

Full Isolation

Container Runtimes

Configuration

Settings File

Per-Project Override

Command Safety

How It Works

Disabling the Sandbox