Mission 9 · Build the boundaries
A workshop away from home
Separate command execution from the bot’s own state.
Sina does need the bot to run a small program. That program might be hostile. You choose where it runs.
Sina
“Can it have a place to work without giving it the keys to the bot’s home?”
The decision
Select all three properties the execution workshop should have.
- Separate from the Hermes instance
A program should not run next to the bot’s memory, settings, or credentials. - No network access
Do not give an untrusted program a route to the internet or the proxy. - Temporary writes that are discarded when the session ends
Do not keep the program’s changes as permanent trusted state. - A shared folder containing the bot’s settings and secrets
Make every file available so the program never gets stuck.
Reveal the explanation
A separate, disconnected, temporary workshop. In the guide, commands go over restricted SSH to another instance and run inside gVisor.
A sandbox is a restricted work area. It should not contain the valuables you are trying to protect.- gVisor adds a user-space kernel boundary between a command and the underlying system.
- The guide combines it with a separate instance and network restrictions; no single layer is treated as perfect.
- Do not assume every tool follows the terminal backend. File tools and code execution must stay disabled until their actual execution location is proven.
Sandbox
A restricted place to run potentially untrusted code with limited access and disposable changes.