Human being interested in distributed systems, execution governance, and the hidden rules behind software.
A few months ago I posted a small note on LinkedIn about a holiday project: Canister , an unprivileged Linux sandbox for running code you don’t fully trust – AI-generated scripts, npm install , build steps from a repo you just cloned. A lot has changed since then, and I mostly stayed quiet about it. A couple of the notes here even slipped out as drafts before I meant to publish them – if you read…
Say you run a piece of untrusted code – an AI-generated script, a dependency’s postinstall hook, a build step from a repo you just cloned – inside a sandbox. You lock it down: no filesystem access outside the working directory, no network except the one domain it legitimately needs, no dangerous syscalls. That stops a lot of bad behavior. It also has a blind spot, and it’s a big one. I ran into…
A sandbox that doesn’t get tested against the thing it’s defending against isn’t a sandbox. It’s a wish. Canister relies on Linux kernel features – user namespaces, seccomp BPF, mount isolation – and on Mandatory Access Control systems like SELinux and AppArmor. These are not things you can meaningfully test in a container. Containers share the host kernel. They don’t run their own SELinux policy…
Last week I asked an AI to write a Python script that processes CSV files. The code looked reasonable. It imported os , subprocess , and urllib . It worked. I shipped it. Later I re-read it and noticed it was shelling out to curl to fetch a dependency at runtime – a URL I never verified. The script also had full read access to my home directory, my SSH keys, my AWS credentials. If that curl target…
This is the first post on this small site. The goal here is simple: to share some of the things I’m currently building, exploring, and occasionally struggling with. Most of my work these days revolves around Envoy Proxy , control planes, and the question of how we can make complex systems easier to reason about and operate. Lately, that exploration has started to include AI and LLMs —not as a…