Most “agent sandboxes” are polite suggestions. Garuda (announced October 8) takes the grown-up route: Seatbelt on macOS, bubblewrap on Linux, no network by default, an audit log, Apache-2.0, and backends that include Ollama, LM Studio, llama.cpp, and vLLM. That is a security design, not a productivity sticker.
This is the threat model I wanted
If a coding agent can hit the network and your secrets directory, you do not have a helper. You have an unreviewed intern with root fantasies. OS-level isolation plus deny-by-default egress is how you sleep at night while the loop runs. Containers help. Kernel sandboxes help more when the tool is rewriting files on a developer machine.
I like that Garuda is honest about local inference. Cloud models are fine for some work. Local models behind a real sandbox are how you work on private code without mailing your tree to a stranger’s GPU farm.
Try it like a security person
Turn it on. Confirm the network stays closed. Read the audit log after a session. Point it at a throwaway repo first. Attempt a deliberate exfil and make sure it fails. If the sandbox holds, then talk about productivity. Order matters. Hype does not patch a missing seccomp profile.
None of this replaces reading the release notes yourself. Models and agent wrappers change weekly. My bar stays the same: license clarity, local option when secrets are involved, and a workflow I can reproduce without a sales call.
Pin the versions you validate. “Latest” is not a release strategy for anything that can write files.
Have a blessed day!