Skip to content
AI News HubLIVE
More
Summary only

Cplt: Run AI coding agents or a plain shell inside a kernel-level sandbox

Cplt is a sandbox wrapper for AI coding agents that provides kernel-level filesystem and environment isolation on macOS and Linux. It protects secrets by restricting access to credentials, SSH keys, cloud configs, and blocking lifecycle scripts. Supports Copilot, OpenCode, and other agents with fine-grained control over files, network, and environment variables.

SourceHacker News AIAuthor: ingve
Cplt: Run AI coding agents or a plain shell inside a kernel-level sandbox
Report an error

The correction channel is not available yet. You can copy the article reference below for later.

Correction instructions

Summary only

Under the source content permission, this page provides an editorial summary, key points, and a link to the original article.

Key points and analysis

Article intelligence

EngineersAdvanced

Key points

  • Kernel-level sandbox for AI coding agents using Apple Seatbelt (macOS) or Landlock+seccomp (Linux).
  • Blocks access to .env, SSH keys, cloud credentials, git hooks, and other sensitive paths by default.
  • Sanitizes environment variables and blocks npm lifecycle scripts as supply chain attack prevention.
  • Network control: only port 443 outbound by default, localhost blocked, with options to allow additional ports.

Highlights and analysis are generated automatically and may contain errors. Check the original source.