diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 19e6990..a88fb97 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -30,12 +30,18 @@ jobs: - name: Validate Marp presentation run: | - mkdir -p site + mkdir -p site/ko site/en npx --yes @marp-team/marp-cli@4 \ - ai-agent-sandboxing.md \ + ai-agent-sandboxing-ko.md \ --html \ --allow-local-files \ - -o site/index.html + -o site/ko/index.html + npx --yes @marp-team/marp-cli@4 \ + ai-agent-sandboxing-en.md \ + --html \ + --allow-local-files \ + -o site/en/index.html + cp index.html site/index.html cp -R assets site/assets - name: Validate PowerShell syntax diff --git a/.gitignore b/.gitignore index ccec682..fe7c1de 100644 --- a/.gitignore +++ b/.gitignore @@ -21,13 +21,13 @@ !.github/** # Presentation source and referenced assets. -!ai-agent-sandboxing.md +!ai-agent-sandboxing-*.md !assets/** !docs/ !docs/** -# Generated GitHub Pages entrypoint. -index.html +# GitHub Pages language redirect. +!index.html # PowerShell scripts and modules. !*.ps1 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 2a0da15..1701ad2 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,37 +1,47 @@ # Contributing -Thank you for improving the presentation materials, demo scripts, and -infrastructure definitions in this repository. +Thank you for improving the presentation materials, demo scripts, and infrastructure definitions in this repository. ## Development prerequisites - Git - Node.js 22 or later for Marp rendering -- PowerShell 7 for PowerShell scripts -- Bash for shell scripts +- PowerShell 7 for PowerShell scripts (Only for Windows users) +- Bash for shell scripts (Only for non-Windows users) - Azure CLI with Bicep support for infrastructure validation ## Make a change 1. Create a branch using `feat/`, `fix/`, or `docs/`. -2. Keep generated HTML, PDF, PowerPoint, speaker-note exports, and previews - out of commits. +2. Keep generated HTML, PDF, PowerPoint, speaker-note exports, and previews out of commits. 3. Update `CHANGELOG.md` when a change affects users of the materials. -4. Use [Conventional Commits](https://www.conventionalcommits.org/) for commit - messages. +4. Use [Conventional Commits](https://www.conventionalcommits.org/) for commit messages. ## Validate presentation changes ```bash +# For English +mkdir -p en/assets +cp -R assets/. en/assets/ npx --yes @marp-team/marp-cli@4 \ - ai-agent-sandboxing.md \ + ai-agent-sandboxing-en.md \ --html \ --allow-local-files \ - -o index.html + -o en/index.html ``` -Review the generated presentation for overflow, broken image links, and -readability. +```bash +# For Korean +mkdir -p ko/assets +cp -R assets/. ko/assets/ +npx --yes @marp-team/marp-cli@4 \ + ai-agent-sandboxing-ko.md \ + --html \ + --allow-local-files \ + -o ko/index.html +``` + +Review the generated presentation for overflow, broken image links, and readability. ## Validate scripts diff --git a/README.md b/README.md index 2aea0eb..a50a2d9 100644 --- a/README.md +++ b/README.md @@ -10,9 +10,10 @@ The primary presentation was prepared for various conferences and meetups, and c . ├── .github/ ├── assets/ -├── ai-agent-sandboxing.md # Marp presentation source +├── ai-agent-sandboxing-ko.md # Korean Marp presentation source +├── ai-agent-sandboxing-en.md # English Marp presentation source ├── docs/ # Demo setup, runbooks, and recovery guides -├── index.html # Generated presentation (ignored) +├── index.html # Redirect to the Korean presentation ├── LICENSE └── README.md ``` @@ -29,29 +30,64 @@ The [demo documentation index](docs/README.md) provides two complete, sequential ## Preview the presentation -1. Install Node.js 22 or later, then generate an HTML presentation: +> [!NOTE] +> To preview the presentation, you'll need 3 terminals. + +1. Install Node.js 22 or later + +1. Generate an HTML presentation for English in Terminal A: + + ```bash + # zsh/bash + mkdir -p en/assets + cp -R assets/. en/assets/ + npx --yes @marp-team/marp-cli@4 \ + --watch \ + ai-agent-sandboxing-en.md \ + --html \ + --allow-local-files \ + -o en/index.html + ``` + + ```powershell + # PowerShell + New-Item -ItemType Directory -Force en/assets + Copy-Item -Recurse -Force assets/* en/assets/ + npx --yes @marp-team/marp-cli@4 ` + --watch ` + ai-agent-sandboxing-en.md ` + --html ` + --allow-local-files ` + -o en/index.html + ``` + +1. Generate an HTML presentation for Korean in Terminal B: ```bash # zsh/bash + mkdir -p ko/assets + cp -R assets/. ko/assets/ npx --yes @marp-team/marp-cli@4 \ --watch \ - ai-agent-sandboxing.md \ + ai-agent-sandboxing-ko.md \ --html \ --allow-local-files \ - -o index.html + -o ko/index.html ``` ```powershell # PowerShell + New-Item -ItemType Directory -Force ko/assets + Copy-Item -Recurse -Force assets/* ko/assets/ npx --yes @marp-team/marp-cli@4 ` --watch ` - ai-agent-sandboxing.md ` + ai-agent-sandboxing-ko.md ` --html ` --allow-local-files ` - -o index.html + -o ko/index.html ``` -1. Run local web server: +1. Run local web server in Terminal C: ```bash npx serve . diff --git a/ai-agent-sandboxing-en.md b/ai-agent-sandboxing-en.md new file mode 100644 index 0000000..fb4a0d0 --- /dev/null +++ b/ai-agent-sandboxing-en.md @@ -0,0 +1,1649 @@ +--- +marp: true +theme: default +size: 16:9 +# paginate: true +# footer: Sandboxing AI Agents +header: '한국어' +--- + + + + + + +# Sandboxing
AI Agents on Ubuntu + +Controlling boundaries with
Docker Sandboxes and Azure Container Apps Sandboxes + +
+ Justin Yoo + Principal Developer Advocate + Microsoft / GitHub + Docker Captain + + + + +
+ + + +--- + +
+AI agents execute commands with my privileges,
+much faster than I can. +
+ +

So, how far should we allow the impact when agents make mistakes or get compromised?

+ + + +--- + + + + +
Risks and Control Boundaries
+
How far should we allow the parameters of AI agents?
+ + + +--- + +## Potential Threats +
+
rm
File Corruption

Deletion or overwriting of source, config, and home directories

+
key
Credentials

Exposure or misuse of tokens and cloud keys

+
net
Data Leakage

Transmission of code and data to unauthorized destinations

+
pkg
Supply Chain

Execution of malicious packages and installation scripts

+
docker.sock
Host Takeover

Access to Docker sockets and local processes

+
+ + + +--- + + + +
Docker Sandboxes comes for rescue
+ +
+
Agent Capabilities

File modification, shell execution, package installation, and network access are necessary

+
→
+
Isolated Execution Boundary

Perform necessary tasks within a microVM isolated from the host

+
+ +
Maintain necessary privileges, but limit the impacting parameters.
+ + + +--- + +## Grant privileges inside, enforce boundaries outside +
+
01
Compute

Separate kernel and process boundaries

+
02
Files

Sharing scope and write permissions

+
03
Network

Destination-based egress policies

+
04
Credentials

Proxy injection with plaintext hidden

+
05
Lifecycle

Automation of creation, suspension, and termination

+
+ + + +--- + +## Security Architecture +
+
AI Agent · sudo · packages · Internal Docker Engine
+
microVM · Kernel isolation · Primary trust boundary
+
Host OS · Host filesystem · Host Docker daemon · Local processes
+
+ +
+
WorkspaceExplicitly shared
+
→
+
Host ProxyPolicies and credentials
+
→
+
Allowed NetworkAllowed destinations only
+
+ + + +--- + +## Direct 🤜🤛 Clone +
+
+

Direct Mode

+ +
+
+

Clone Mode

+ +
+
+ +

In Direct Mode, even with sandboxes, projects stored on the host are affected.

+ + + +--- + + + + +
DEMO #1
+
Modernizing .NET Apps
in Docker Sandboxes
+ + + +--- + +## Demo #1: Modernizing .NET Apps in Docker Sandboxes + + + + +--- + + + +## Demo #1: Modernizing .NET Apps in Docker Sandboxes +```bash +sbx secret set github --command 'gh auth token' +sbx run --clone --name dotnet-appmod copilot . +sbx exec -it dotnet-appmod bash +``` + +
+
AuthenticateInject token via host proxy
+
→
+
RunSandbox + Copilot CLI
+
→
+
ShellAccess for installation and status checks
+
+ + + +--- + + + +## Demo #1: Modernizing .NET Apps in Docker Sandboxes +
/plugin marketplace add microsoft/github-copilot-modernization
+/plugin install github-copilot-modernization@github-copilot-modernization
+ + + +--- + +## Demo #1: Modernizing .NET Apps in Docker Sandboxes +
copilot → /agent → github-copilot-modernization:modernize
+ +
+
AssessmentAnalyze dependencies, .NET, and risks
+
→
+
PlanningCreate actionable task plans
+
→
+
ExecutionModify, build, and validate
+
+ +
+
assessment/

Modernization assessment results

+
plan.md · tasks.json

Reviewable execution plans

+
task commits

Change history per task

+
+ + + +--- + +## Demo #1: Modernizing .NET Apps in Docker Sandboxes +
Modernize this application
+
Modernize this app to .NET 10
+ + + +--- + +
+We've executed it safely in a local machine.
+Now, how do we operate it at team and service scale? +
+ +
+
Machine Dependency

Dependent on developer machine's status and availability

+
Lifecycle Automation

Need automated interfaces for creation, suspension, and termination on demand

+
Concurrent Execution

Isolated operation of multiple users and agents

+
+ + + +--- + + + + +
From Local to Cloud
+
Scaling lifecycle and capacity
with Azure Container Apps Sandboxes
+ + + +--- + +## What if we move sandboxes to the cloud? +
+
ACA CLIPortal · SDK · Bicep · Skills
+
→
+
Sandbox GroupPolicies, images, networking
+
→
+
SandboxIsolated stateful execution
+
→
+
SnapshotMemory and disk
+
+ +

Microsoft.App/SandboxGroups · Azure Container Apps Sandboxes

+ + + +--- + +
+
< 1s
Fast Startup

Sub-second provisioning using pre-warmed pools

+
∞
Massive Scaling

Zero-to-Scale · Scale from zero to thousands of concurrent sandboxes

+
⏸︎ ▶︎
Suspend / Resume

Preserve state during idle periods and resume quickly

+
ID
Azure Governance

Entra ID, RBAC, Azure resource boundaries

+
VNet
Networking

Ingress and egress policies with virtual network integration

+
OCI
Custom Images

Use pre-configured toolchains as root filesystems

+
+ + + +--- + + + + +
DEMO #2
+
Using Copilot CLI
in ACA Sandboxes
+ + + +--- + +## Demo #2: Using Copilot CLI in ACA Sandboxes + +
+
+

1 · Prepare Sandbox Group

+ 
aca sandboxgroup create \
+  --name ghcp-sandbox-demo \
+  --location koreacentral \
+  --set-config
+
+
+

2 · Create Sandbox

+ 
aca sandbox create \
+  --disk copilot \
+  --credential <copilot-credential-id> \
+  --label name=ghcp-demo
+
+
+ +
+ Sandbox Group Configuration Saved + → + Sandbox ID · Running +
+ + + +--- + + + +## Demo #2: Using Copilot CLI in ACA Sandboxes + +
$ aca sandbox shell -l name=ghcp-demo
+
+workspaces$ git clone https://github.com/devkimchi/battle-school-lunch.git
+workspaces$ cd battle-school-lunch
+workspaces$ copilot
+ +
+ Clone→ + Move to Working Directory→ + Run Copilot CLI +
+ + + +--- + +## Demo #2: Using Copilot CLI in ACA Sandboxes + +
I want to change this project's Web UI to Brutal Design style. Don't modify the code, just write the change plan to a design-update.md file
+ + + +--- + +## Demo #2: Using Copilot CLI in ACA Sandboxes + +
+
+

1 · Suspend

+ 
aca sandbox stop \
+  -l name=ghcp-demo
+
+
+

2 · Resume

+ 
aca sandbox resume \
+  -l name=ghcp-demo
+
+
+ + + + + +--- + + + + +
What to choose and
What to defend
+
Product selection criteria and remaining risks
+ + + +--- + +## Docker Sandboxes 🤜🤛 ACA Sandboxes + + + + + + + +
CriteriaDocker SandboxesACA Sandboxes
Primary UsersIndividual developersTeams, services, multi-tenant
Execution LocationLocal PCAzure-managed infrastructure
Creation MethodsInteractive CLIPortal · CLI · SDK · Bicep · Skills
State LifecycleLocal persistencesnapshot · suspend · resume
Massive ConcurrencyMachine capacity limitsScale to thousands
+ + + +--- + +## Risks remain even with sandboxes +
+
Network and Credentials

Information can be leaked to allowed destinations or granted privileges misused

+
Supply Chain Attacks

Malicious packages, plugins, images, and installation scripts can be executed

+
Generated Content Contamination

Code, build scripts, and CI configurations must be reviewed before external execution

+
External Tool Trust

MCP servers, Skills, and external APIs represent separate trust boundaries

+
+ + + +--- + +## Risks remain even with sandboxes +
+
+

Docker Sandboxes

+
Direct Mode

Changes to shared workspaces immediately affect the host

+
Host Integration

Local stdio MCP and shared Skills connect to host resources outside the microVM

+
+
+

ACA Sandboxes

+
RBAC and Tenant Isolation

Errors in role scope or user-to-sandbox mapping can expose privileges

+
Residual State Data

Code, logs, and sensitive data can remain in snapshots and volumes

+
+
+ + + +--- + + + +
+Sandboxes don't
guarantee for security on
AI coding agents like GitHub Copilot.
+Instead, they add a defense layer that minimizes risks +
+ + + +--- + +## Key Takeaways +
1

Grant agents the privileges they need, but enforce boundaries from outside.

+
2

Use Docker Sandboxes for interactive execution on developer PCs, and ACA Sandboxes for remote automation and multi-execution.

+
3

Sandboxes make troubles small, observable, and disposable.

+ + + +--- + +## Want to learn more about sandboxes? + +
+
+
Docker Sandboxesdocs.docker.com/ai/sandboxes
+
Docker Sandboxes Security Modeldocs.docker.com/ai/sandboxes/security
+
Running GitHub Copilot CLI in Docker Sandboxesdocs.docker.com/ai/sandboxes/agents/copilot
+
+
+
Modernizing Java Apps with Copilot CLIaka.ms/ghcp/appmod/java
+
Modernizing .NET Apps with Copilot CLIaka.ms/ghcp/appmod/dotnet
+
Azure Container Apps Sandboxes Introductionaka.ms/aca/sandboxes
+
Azure Container Apps Sandboxes Documentationsandboxes.azure.com/docs
+
+
+ + + +--- + + + + +
Thank You
+ +
+Sandboxing AI Agents on Ubuntu +
+ +
+ devkimchi.com/github-copilot-sandbox +
+ +
+ Justin Yoo| + Principal Developer Advocate| + Microsoft/GitHub| + Docker Captain| + GitHub @justinyoo| + LinkedIn @justinyoo +
+ + \ No newline at end of file diff --git a/ai-agent-sandboxing.md b/ai-agent-sandboxing-ko.md similarity index 97% rename from ai-agent-sandboxing.md rename to ai-agent-sandboxing-ko.md index 6ef3808..1410871 100644 --- a/ai-agent-sandboxing.md +++ b/ai-agent-sandboxing-ko.md @@ -4,6 +4,7 @@ theme: default size: 16:9 # paginate: true # footer: AI 에이전트 샌드박싱 +header: 'English' ---