Gondolin Wraps AI Agent Sandboxes in a JavaScript Security Control Plane
Gondolin runs agent-generated code inside disposable Linux micro-VMs while the host mediates every network call and injects secrets the guest never sees.
PRO- Gondolin runs agent code in Linux micro-VMs with a TypeScript control plane mediating all I/O
- Secrets stay on the host and are injected into HTTP headers only for allowlisted destinations
- TLS is terminated via a local MITM CA so requests can be inspected and replayed through
fetch - Non-HTTP/TLS/SSH traffic is dropped; UDP is blocked except DNS, with a synthetic mode by default
- Filesystem is a programmable VFS with in-memory, real, and readonly providers written in JavaScript
- Apache-2.0, QEMU default with experimental libkrun backend, sub-second boot on Mac and Linux
A new open source project called Gondolin takes a different approach to the agent sandbox problem. Instead of relying on containers or seccomp filters, it boots a real Linux micro-VM per task and puts a TypeScript control plane between the guest and the outside world. Every packet the sandbox tries to send, and every file it tries to read, passes through JavaScript you control.
The pitch aims squarely at teams shipping coding agents. AI agents increasingly run generated code without human review, and that code often needs network access and credentials, which creates exfiltration risk. Gondolin bounds that risk without giving up the flexibility of a full Linux environment.
A VM with a JavaScript nervous system
The architecture splits cleanly across the QEMU boundary. A trusted Node.js process holds the policy, the real secrets, and the VFS providers. The guest Linux VM is treated as untrusted and sees an eth0 whose traffic is intercepted by the host, plus a /data FUSE mount whose operations are served by host providers. Arbitrary processes still run inside via a small daemon called sandboxd.
The network stack itself is written in TypeScript. Lightweight micro-VMs boot in under a second on Mac or Linux, and the virtual filesystem is also implemented entirely in JavaScript, giving programmatic control over what the sandbox can access and what secrets it can use. QEMU is the default backend, with an experimental libkrun runner available on macOS and Linux.
This story is for Pro members
You've reached the end of the free preview. Upgrade to AlphaSignal Pro to read the full article - and everything else behind the paywall.
Comments
