Tool Execution Sandbox — References

The isolation primitives themselves, the published designs that combine them, and the guidance on configuring them to be a boundary rather than a convenience.

Primitives

• Linux namespaces — the manual page describing each namespace type and what it does and does not separate.
• seccomp — system call filtering, the mechanism that reduces the kernel surface a confined process can reach.
• capabilities — the decomposition of privilege that determines what remains possible after dropping root.
• OCI Runtime Specification — the normative description of what a container configuration contains, which is where the isolation settings of a given deployment are actually recorded.

Designs

• Firecracker: Lightweight Virtualization for Serverless Applications (Agache et al.), USENIX NSDI 2020 — a microVM monitor built to make per-workload virtual machines cheap enough to use per request. Cited by name.
• gVisor — an application kernel in user space, including its documentation of the compatibility and performance costs of intercepting system calls.
• WebAssembly — the specification and ecosystem for a sandboxed execution format whose host access is granted explicitly rather than inherited.

Configuring a boundary

• Application Container Security Guide — NIST Special Publication 800-190. Systematic treatment of container threats including image provenance, runtime configuration, and the limits of kernel-sharing isolation. Cited by name.
• OWASP Cheat Sheet Series — the container security and server-side request forgery sheets, both directly relevant to what confined code can reach.
• CWE-918: Server-Side Request Forgery — the weakness class behind reaching a host metadata endpoint or an internal service from a context that was supposed to be outward-facing only.

No verified reference is recorded for sandbox design specific to model-generated code, or for resetting pooled execution environments safely. Published work addresses untrusted code generally and transfers without modification; nothing agent-specific is recorded here.