Skip to main content

Overview

Every agent execution in UseZombie runs under four isolation layers. These layers are applied by the executor sidecar before the agent begins work and are enforced for the entire duration of the execution.

Layer 1: Filesystem isolation (Landlock)

Landlock is a Linux security module (available since kernel 5.13) that restricts filesystem access at the process level without requiring root privileges.

Filesystem policy table

PathAccessPurpose
Workspace directory (/tmp/zombie/runs/<run_id>/)Read-writeThe cloned repository where the agent implements changes.
/usr/bin, /usr/lib, /libRead-onlySystem binaries and libraries needed for compilation toolchains.
/usr/local/binRead-onlyLocally installed tools (compilers, interpreters).
/etc/ssl/certsRead-onlyTLS certificates for registry access (when allowlisted).
/tmp (private namespace)Read-writeAgent temporary files. Isolated via PrivateTmp.
Everything elseDeniedNo access to host config, other workspaces, credentials, or system state.
If the agent attempts to access a denied path, the system call returns EACCES. The denial is logged and increments the landlock_denials_total metric.

Layer 2: Resource limits (cgroups v2)

Each agent execution runs in its own cgroups v2 scope with memory and CPU limits.

Memory

  • Default limit: 512 MB (EXECUTOR_MEMORY_LIMIT_MB).
  • Enforcement: kernel OOM killer terminates the process if the limit is exceeded.
  • Detection: executor reads cgroup OOM events after execution completes.
  • Metric: oom_kills_total.

CPU

  • Default limit: 100% of one core (EXECUTOR_CPU_LIMIT_PERCENT).
  • Enforcement: cgroups CPU bandwidth control throttles the process.
  • Detection: executor reads cpu.stat for throttled time.
  • Metric: cpu_throttled_ms_total.

Layer 3: Network isolation

Network access is denied by default using a dedicated network namespace with no routes.
PolicyBehavior
deny_all (default)No outbound connections. All connect() calls fail with ENETUNREACH.
registry_allowlistOutbound connections permitted only to allowlisted registry hosts (npm, PyPI, crates.io, Go proxy). All other destinations denied.
The network policy is configured via EXECUTOR_NETWORK_POLICY. See Sandbox configuration for the allowlist details.

Layer 4: Process isolation (systemd hardening)

The executor systemd service applies additional process-level restrictions:
DirectiveEffect
PrivateTmp=true/tmp is a private mount, not shared with other services.
ProtectSystem=strictThe entire filesystem is read-only except explicitly allowed paths.
NoNewPrivileges=trueThe process cannot gain new privileges via setuid, setgid, or capabilities.

Failure classification

When an agent execution fails due to sandbox enforcement, the failure is classified and recorded:
Failure classError codeMetricDescription
TimeoutUZ-EXEC-003timeout_kills_totalExecution exceeded its timeout and was killed.
Posture failureUZ-EXEC-009Per-run sandbox posture check failed at executor startup.
OOM killoom_kills_totalMemory limit exceeded, process killed by kernel OOM.
Filesystem deniallandlock_denials_totalAgent tried to access a denied path.
Network denialAgent tried to make a blocked network connection.
Resource killresource_kills_totalAggregate: any resource-based kill (OOM, timeout, CPU).