Back to feed
Dev.to
Dev.to
7/11/2026
Re: --network none is your best friend — here's our full sandbox config + gVisor update

Re: --network none is your best friend — here's our full sandbox config + gVisor update

Short summary

A detailed Docker sandbox configuration for running MCP servers safely, combining --network none, read-only rootfs, capability dropping, and gVisor's runsc runtime for userspace syscall interception. The setup blocks ptrace, bpf, mount, and kexec_load attempts, and has been used to audit 8,764 MCP servers. An egress proxy with allowlisting is planned as the next layer.

  • •Full L2.5 sandbox config: read-only rootfs, cap-drop ALL, no-new-privileges, gVisor runsc
  • •gVisor intercepts all syscalls in userspace, blocking ptrace, bpf, mount, and kexec_load
  • •8,764 MCP servers audited with this configuration; egress proxy allowlist planned next

Generated with AI, which can make mistakes.

#ai-agents#ai-tools#open-source
Read full article at Dev.to

Is this a good recommendation for you?

Comments

Failed to load comments. Please try again.

Explore more

Response to 'gVisor vs Firecracker for AI Agent Sandboxing' — what we learned auditing 8,764 MCP servers
Dev.to
Docker Rootless Mode Security Hardening Checklist
Dev.to
Sandboxing untrusted agent code with gVisor costs ~200ms per cold start. Blocking syscalls instead of emulating them costs ~8ms
Dev.to
Running Docker on Proxmox: LXC vs VMs and the Firewall Rules That Actually Matter
Dev.to