From f2e2572a401799d607096f003f7c06549f29778e Mon Sep 17 00:00:00 2001 From: didericis Date: Sat, 18 Jul 2026 06:41:26 -0400 Subject: [PATCH] =?UTF-8?q?docs(research):=20add=20DX=20axis=20=E2=80=94?= =?UTF-8?q?=20"run=20Claude=20yolo-style"=20=E2=80=94=20to=20the=20sandbox?= =?UTF-8?q?=20landscape?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds a "DX: run Claude yolo-style" row to the comparison table plus a note framing developer experience as a differentiator. The field splits into wrappers-around-the-agent (bot-bottle, agent-safehouse — one command, the agent just runs, `--dangerously-skip-permissions` on by default with the sandbox as the guardrail) vs libraries/services (boxlite, microsandbox, CubeSandbox, E2B — you wire the agent in via SDK/cluster). agent-safehouse is the only DX peer, but it's macOS-only Seatbelt with no egress story. "As easy as native yolo, but actually sandboxed" is the defensible line. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01YBCHap11yGAKuKfsehNPaD --- docs/research/agent-sandbox-landscape.md | 29 ++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/docs/research/agent-sandbox-landscape.md b/docs/research/agent-sandbox-landscape.md index 78c289d..23665f3 100644 --- a/docs/research/agent-sandbox-landscape.md +++ b/docs/research/agent-sandbox-landscape.md @@ -221,6 +221,7 @@ claim that the monetization positioning leans on. See the addendum. | Network policy | Default-deny via own egress scanner + per-bottle allowlist + content DLP + gitleaks on git push | Capability model only | Limited | Not addressed | Default-deny + allowlist + secret-injecting proxy | Default-deny + logging | Per-VM net (unverified) | Not documented | Off by default + allowlist | Default-deny allowlist + instant egress block + audit logs + per-sandbox tokens (eBPF) + credential vault | | Parallel agents | Yes (one bottle per agent) | n/a | Not addressed | One at a time | Multiple VMs | Yes (dashboard) | SDK-level | SDK-level | Architectural | Yes (2,000+/host claimed) | | Long-running posture | Persistent by default (named, supervised) | n/a (demo) | Session (up while in use) | Per-invocation | Ephemeral VM per run | Per-run (versioned) | Ephemeral + snapshot/fork | Ephemeral / on-demand | Named persistent by default | Ephemeral + auto pause/resume | +| DX: run Claude yolo-style | One command → interactive yolo Claude (`start `, `--dangerously-skip-permissions` default) | n/a (lib demo) | Wizard + build, then run claude inside (Linux only) | One-command wrapper (`safehouse claude --dangerously-skip-permissions`) | CLI: run a cmd in a VM (not a Claude wrapper) | Hosted (`tilde exec`), not local-native | SDK code required (build the run yourself) | CLI/MCP: sandbox-as-a-tool for the agent, not a wrapper around it | SSH into a named machine, run claude there | Stand up a cluster + drive via E2B SDK | | Config | JSON manifest (bottles + agents) | Programmatic refs | CLI wizard | Profile files / shell fns | CLI / SDK | DSL + CLI + SDK | SDK | CLI / SDK / MCP | TOML Smolfile | E2B-compatible SDK | | Maturity | Active May 2026 | Research (2022+) | Early (~66 ⭐) | Active (~1.4k ⭐) | Experimental (~574 ⭐) | Private preview | YC, ~4.7k ⭐ | YC, ~6k ⭐, beta | ~3.1k ⭐ | Tencent, prod, ~10.4k ⭐ | @@ -350,6 +351,34 @@ persistent-by-default project in this set. For anyone building agents that run for hours/days, this posture difference matters more than the isolation primitive. +**DX — the "run Claude yolo-style" bar.** The reason `claude +--dangerously-skip-permissions` is so widely used is DX: it's one command +and the agent just goes. The bottle thesis is to make a *sandboxed* run +that easy — `start ` builds the image on first run and drops you +into an interactive Claude session that already has +`--dangerously-skip-permissions` on by default +(`contrib/claude/agent_provider.py`), with the sandbox as the guardrail +instead of per-action prompts. On this axis the field splits cleanly: +- **Wrappers around the agent** (as-easy-as-native): bot-bottle and + **agent-safehouse** (`safehouse claude --dangerously-skip-permissions`). + These *are* the run-Claude experience. agent-safehouse is the real DX + peer — but it's macOS-only Seatbelt, single-run, and doesn't address + network egress; bot-bottle adds VM-grade isolation, egress DLP, and + persistent/parallel bottles across macOS + Linux. +- **Libraries / services** (you build the run yourself): boxlite, + microsandbox, CubeSandbox, E2B. These hand you an SDK or a cluster and + expect you to wire the agent in — powerful for platform builders, + heavyweight for "just run Claude on my laptop." microsandbox's MCP/Skills + angle is *sandbox-as-a-tool the agent calls*, which is the inverse of + wrapping the agent. +- **In between:** litterbox (wizard + build, Linux only), smolmachines + (SSH into a named machine), matchlock (run a command in a VM). + +So DX is a genuine bot-bottle differentiator, and the only project that +matches it (agent-safehouse) does so with materially weaker isolation and +no egress story. "As easy as native yolo, but actually sandboxed" is a +defensible one-liner. + Why it still doesn't collide head-on: 1. **Shape.** CubeSandbox is a *multi-tenant service for platform