Kyle Quest (the DockerSlim guy)

First time going to Bsides Seattle or any other Bsides! Already got pretty good interest and great questions about the talk on day 1 🙂

GitHub - GoogleCloudPlatform/cloud-run-sandbox: On demand code execution sandboxes on top of Google Cloud Run On demand code execution sandboxes on top of Google Cloud Run - GoogleCloudPlatform/cloud-run-sandbox

And now Google is getting into AI sandboxes reusing and rebranding their existing code execution tech 🙂 github.com/GoogleCloudP...

Quentin Deslandes will speak on 'bpfilter: an eBPF-based firewall for fast packets filtering!' as part of our Kernel & Low Level Systems track at SCaLE 23x. Full details: www.socallinuxexpo.o...

Docker sandboxes now appear to use micro-VMs... Now it's getting interesting :-)

Looks like the hidden TeammateTool in Claude Code is getting a lot of interest... The version I reversed engineered, 2.1.9, unfortunately doesn't have it, but now there's a reason to do it again 🙂

That's pretty funny! If they get to decide when to escape it then it's not really sandboxing :-)

anti-patterns and patterns for achieving secure generation of code via AI I just finished up a phone call with a "stealth startup" that was pitching an idea that agents could generate code securely via an MCP server. Needless to say, the phone call did not go well. What fol...

Cool blog about "anti-patterns and patterns for achieving secure generation of code via AI" by the Ralph Loop guy himself ( TLDR: security needs to be deterministic and LLM prompts don't give you that 🙂 ): ghuntley.com/secure-codeg...

Pretty cool... hardened open source container images from the german government container.gov.de , gitlab.opencode.de/open-code/oci

That's a better way to do it where it's ok if the LLM "gun" goes off accidentally or intentionally (e.g., due to a prompt injection) :-)

Giving it blanks could be an option in some cases too

Don't give your LLM a gun if you don't want it to shoot... Asking nicely in the system prompt doesn't work 🙂

With a full and "physically" unrestricted "Bash" tool the LLM will still find a way around those instructions especially with who knows what contained in the files the agent reads 🙂

Notice how much the system prompt tries to influence its model to be read-only. That prompt covers the basic (and non-malicious) happy path pretty well though the prompt itself is the evidence that they had to update it a few times to force that read-only behavior.

Don't give your LLM a gun if you don't want it to shoot... Asking nicely in the system prompt doesn't work 🙂

The code "Explore" agent from Claude Code code snippet I shared earlier is a good "bad" example of that.

The Design & Implementation of Sprites So that we may educate as well as horrify: the internals of our new Sprites execution platform.

Cool follow up post about the design behind the Sprites agent sandboxes from Fly dot IO (from Thomas Ptacek himself :-)) fly.io/blog/design-...

The code "Explore" agent from the reverse engineered Claude Code (much bigger system prompt compared to "Bash" :-))

the next one will be for the "Explore" agent that's used to explore code...

A snippet of the reverse engineered Claude Code showing its "Bash" agent (one of the smallest system prompts in CC :-))

Understanding Manus sandbox - your cloud computer Learn how Manus Sandbox gives you a secure, isolated cloud computer for every task—with persistent files, 24/7 execution, and Zero Trust security built in.

if you want to learn about Manus AI sandboxing... I know I do 🙂 manus.im/blog/manus-s...

Pretty cool, sandboxes from Fly dot IO
sprites.dev

Reverse engineering Claude Code is a fun way to start the new year 🙂 It's the biggest AI coding agent out there and it's a Bun app compiled to an executable.

A teaser 😉

ripgrep.node
resvg.js
tree-sitter.js
ripgrep.js
ripgrep.node
resvg.wasm
tree-sitter.wasm
...

Detecting "persistence" is one of the key features in security tools like EDR (that's one of the first things CrowdStrike had when the team was building the product early on) and this makes it possible to evade them. No "persistence", no detection 🙂

What if you could make your container vulnerabilities disappear... so you can later exploit them whenever you want 😉 I'll show what it looks like at Besides Seattle this February

YouTube video by Lenny's Podcast Why securing AI is harder than anyone expected and the coming security crisis | Sander Schulhoff

Interesting to hear someone (not a rando) saying that "AI guardrails don't work" (so all those AI Security companies selling guardrails are selling snake oil. He didn't say this part out loud :-)) www.youtube.com/watch?v=J998...

GitHub - shurankain/skreaver: AI-native Multi-Agent Coordination Layer — built in Rust. AI-native Multi-Agent Coordination Layer — built in Rust. - shurankain/skreaver

here's the Github repo for it: github.com/shurankain/s...

If you are building AI agents in Rust, Skreaver is a pretty cool project to check out. It aims to be the Tokio of agent systems.

In the battle of autonomous coding agents between Github Copilot and Google Jules fixing a bug in #DockerSlim , GitHub Copilot won while Jules got lost so many times before coming up with anything relevant 🙂

Kubernetes 1.35 Cheat Sheet | Rawkode Academy Your comprehensive guide to Kubernetes 1.35 - breaking changes, new GA features, AI/ML scheduler primitives, and migration checklist. Free for cloud native engineers.

Want to be prepared for #Kubernetes 1.35 next week?

Check out the @rawkode.academy 1.35 Cheatsheet!

Wonder why I mentioned React2shell... Those vulnerable Next.js apps often run in containers and guess what happens to the exploits if those containers are Minted and reinforced with what I've built 😉 Powered by #DockerSlim tech.

YouTube video by Theo - t3․gg Watch this if you use React

Pretty nice video about React2Shell from Theo, the big Next.js vulnerability that's making its rounds: www.youtube.com/watch?v=UiCE... It also show the fundamentally different approach from developers vs security people to the security vulnerabilities.

And, of course, it means the opposite. It'll slow down the defenders scrambling to understand and triage the technical details to have the right kind of mitigation...

React2Shell even got its own website, but sadly there's still default security by obscurity thinking in many publications where people think that by not talking about the actual vulnerability it'll stop bad guys.