---
title: "Gondolin Wraps AI Agent Sandboxes in a JavaScript Security Control Plane"
subtitle: "Gondolin runs agent-generated code inside disposable Linux micro-VMs while the host mediates every network call and injects secrets the guest never sees."
url: "https://alphasignal.ai/news/gondolin-wraps-ai-agent-sandboxes-in-a-javascript-security-control-plane"
author: "AlphaSignal Newsroom"
author_url: "https://alphasignal.ai/editorial-team"
company: "AlphaSignal"
company_url: "https://alphasignal.ai/company/alphasignal"
published: "2026-05-01T21:25:34.000Z"
updated: "2026-08-22T04:11:05.591Z"
type: "Repo"
topics:
  - "Agents"
  - "Infra"
subtopics:
  - "Computer Use"
  - "Guardrails"
  - "Model Serving"
upvotes: 23
source_url: "https://github.com/earendil-works/gondolin"
comments: 0
truncated: true
---

# Gondolin Wraps AI Agent Sandboxes in a JavaScript Security Control Plane

> Gondolin runs agent-generated code inside disposable Linux micro-VMs while the host mediates every network call and injects secrets the guest never sees.

A new open source project called [Gondolin](https://github.com/earendil-works/gondolin) takes a different approach to the agent sandbox problem. Instead of relying on containers or seccomp filters, it boots a real Linux micro-VM per task and puts a TypeScript control plane between the guest and the outside world. Every packet the sandbox tries to send, and every file it tries to read, passes through JavaScript you control.

The pitch aims squarely at teams shipping coding agents. AI agents increasingly run generated code without human review, and that code often needs network access and credentials, which creates exfiltration risk. Gondolin bounds that risk without giving up the flexibility of a full Linux environment.

## A VM with a JavaScript nervous system

The architecture splits cleanly across the QEMU boundary. A trusted Node.js process holds the policy, the real secrets, and the VFS providers. The guest Linux VM is treated as untrusted and sees an `eth0` whose traffic is intercepted by the host, plus a `/data` FUSE mount whose operations are served by host providers. Arbitrary processes still run inside via a small daemon called `sandboxd`.

The network stack itself is written in TypeScript. Lightweight micro-VMs boot in under a second on Mac or Linux, and the virtual filesystem is also implemented entirely in JavaScript, giving programmatic control over what the sandbox can access and what secrets it can use. QEMU is the default backend, with an experimental libkrun runner available on macOS and Linux.

_Preview only. Full text requires an AlphaSignal Pro account._

## Sources

- [earendil-works/gondolin on GitHub](https://github.com/earendil-works/gondolin)
- [Gondolin Documentation](https://earendil-works.github.io/gondolin)
- [Gondolin Security Design](https://earendil-works.github.io/gondolin/security/)