Safety Isolation And Governance

Operator runs arbitrary LLM-generated code and reasons about what the Firecracker microVM does and does not protect.

Rely on the microVM as the boundary that protects the host and other tenants from code inside a sandbox — that is its purpose. But understand it does NOT protect in-sandbox secrets, mounted data, or network egress from the code running inside; those require operator-side scoping. Design assuming in…

Generated code runs a fork bomb or allocates until OOM inside the sandbox, trying to destabilize the run.

Rely on the microVM's resource ceilings to contain a fork bomb / OOM to that one sandbox (it cannot take down the host or neighbors), and on the operator side, bound per-execution time and detect a wedged sandbox to recreate it. Treat resource exhaustion as expected adversarial behavior for untrust…

A task needs a single read-only API token. The operator passes a broad set of cloud credentials into the sandbox 'to be safe.'

Inject only the minimum secret the task needs, at sandbox runtime, with the narrowest scope (read-only, single-resource), never baked into the template/image. Assume any secret placed in a sandbox running untrusted code can be read by that code. Prefer short-lived/scoped tokens over long-lived broa…