bubblewrap/Landlock/seccomp, microVMs, and a kernel-enforced egress proxy

Context

Tools spawn processes and parse hostile content. Network policy enforced inside an application is not enforcement.

The three plans

• Grok: bubblewrap or Landlock + seccomp for tool processes; net kill via rfkill + nftables with a badge.
• Fable: systemd hardening plus bubblewrap; a per-domain egress allowlist in policy.
• Codex: a sandbox executor zone; microVMs for risky code; prompt-injection boundaries.

Decision

Spawned tools run under bubblewrap + Landlock + seccomp with scoped mounts, limits and no network unless policy grants it. Every daemon carries systemd hardening. High-risk code runs in a microVM (microvm.nix). Parsers of untrusted content (PDF, archives, images, web) run in session sandboxes, never in tacidd. Network policy is enforced in the kernel: nftables rules installed by the stem pin the agent uids to tacid-egress, which enforces the allowlist, injects credentials, writes the ledger and implements one-command airgap with a badge (Fable’s allowlist made real, after review).

Consequences

• One more process; one fewer lie.
• Cloud API keys are never in tacidd’s memory.
• Airgap is a reflex, not a setting.

Alternatives rejected

• Allowlist enforced by the HTTP client: bypassed by any tool with a socket.
• Containers as the sandbox: heavier, and not a security boundary without the same primitives.