SysConf 2026 · Locked
How to Safely Give AI Agents a Terminal
Alex Idowu · Co-founder & CTO, PipeOps · Lagos
Sat 3 Oct · 12:25-12:55 WAT · Room 1 · Standard 30m
If your agent (or someone else's) gets a shell on a machine you care about, this is the isolation pattern I ship - disposable terminals, limits, network, gVisor, outbound BYOS. Live Rexec demo. Not a prompting talk.
Public deck unlocks after the session (2026-10-03). Field notes stay public.
Field notes · Repo · All talks
SysConf 2026 · Standard
How to Safely Give AI Agents a Terminal
Alex Idowu · Co-founder & CTO, PipeOps · Lagos
Sat 3 Oct 2026 · 12:25-12:55 WAT · Room 1
25 min talk + 5 min Q&A · live Rexec sandbox demo
Present · P or button · Navigate → ← · Esc exits · Deep link ?present=1
01 · Title
How to Safely Give AI Agents a Terminal
Alex Idowu · PipeOps · Lagos
SysConf 2026 · Room 1
02 · Who this is for
Who this is for
Anyone giving an agent a shell on infra you care about.
- You use coding agents on a laptop, bastion, or CI runner
- You build products where agents exec commands for users
- Platform / SRE / security owning the blast radius
Not a prompting talk. Not “how to build an agent.”
Sandbox and lifecycle. I hit this building Rexec and shipping multi-tenant platforms.
03 · The claim
AI agents need a terminal to be useful.
Giving them yours is a bad idea.
The moment the model runs npm install, curl | bash, or “explore the filesystem,” you left chat.
Untrusted remote code execution with a friendly UI.
04 · What people actually do
What people actually do
- Install Cursor / Claude Code / some agent CLI on a laptop
- Point it at a real repo
- Leave network + package install on
- Trust system prompts and “approve tool use”
Same pattern on a bastion or shared runner - just a bigger blast radius.
Hope is not a control.
05 · What breaks
What breaks (no jailbreak required)
- Secrets written to world-readable files
rm -rfwith a creative path expansion- Env vars leaving over HTTPS or DNS
- Packages that phone home
- Production kubeconfigs sitting in
~/.kube - Three package managers, half-broken state, “works in the agent’s world”
Models sound careful. They still thrash. Blast radius = that machine.
06 · Why human SSH habits fail
Why “I SSH carefully” is not enough
| You | The agent | |
|---|---|---|
| Pace | One command, think | Burst of tool calls |
| Intent | Usually deliberate | Explores and retries |
| Network | You decide outbound | It will try outbound |
| Lifetime | Hours is fine | Should die in minutes |
Same Docker host. Different threat model.
07 · What I mean by sandbox
What I mean by sandbox
Not a system prompt. Not a longer “be careful” instruction.
Create → hard limits → network mode → run → delete.
Optional: record the session when the risk is high.
“Approve tool use” on your laptop is still RCE with a dialog.
08 · Checklist I actually use
Checklist I actually use
- Disposable - no leftover container from Tuesday
- CPU / memory / PID caps (disk if the host can)
- Network chosen at create time - not “we’ll lock it later”
- API / headless attach - agents don’t click xterm
- Prefer outbound tunnels for real machines - not open port 22
Platform engineering: terminals as create/delete primitives.
09 · Two shapes I ship
Two shapes I ship in Rexec
Don’t confuse them. Most teams eventually need both.
10 · What the container looks like
What the container looks like
- Docker / Podman with hard CPU, memory, PID limits
- Capabilities dropped +
no-new-privileges - Bridge with ICC off (
rexec-isolatedin our stack) - OCI runtime
runsc- gVisor, not stock runc by default - Attach over API / WebSocket - no published SSH into the sandbox
Copy the shape even if you never run Rexec. Jobs + RuntimeClass + NetworkPolicy gets you most of the way.
11 · Live demo
Live: create → prove isolation → delete
- Create a sandbox with network locked down
- Show the block (egress or peer) - not a slide claim
- Run something agent-shaped
- Delete. Treat disk and memory as gone
Wifi bad? Screenshots of the same four steps. Don’t fight the venue network.
12 · How hard is hard enough
How hard is hard enough
- cgroup + caps + network - baseline hygiene
- gVisor (
runsc) - smaller host syscall surface (what I default for agents) - Firecracker / microVM - when the threat model or compliance says so
- Dedicated node / account - real isolation budget, not cosplay
Same honesty as soft vs hard multi-tenancy: containers alone are not a hostile multi-tenant boundary. Name the rung you’re buying.
13 · Network (the part people skip)
Network is where this usually fails
A sandbox with a shell is a network endpoint. If you only isolate the filesystem, you left the door open.
- Sandbox talking to another sandbox
- Hitting the host / cloud metadata
- Exfil over normal HTTPS
- Exfil over DNS
- Published ports “just for the demo”
Pick egress at create time: none, allowlist, or full (you accepted the leak).
ICC off is not “no internet.” Say that in the design review.
14 · Session lifecycle
Session lifecycle
- Create - image, limits, network mode
- Inject secrets - short-lived only
- Run - headless by default
- Attach - only if a human must intervene
- Delete - the security feature people forget
Long-lived “dev sandboxes” become bastions with worse accountability.
15 · When you need the real box
When you need the real box (BYOS)
GPU box. Lab server. That machine with the special NIC.
Outbound WebSocket from the host. No inbound SSH for the demo.
| Need | What I prefer |
|---|---|
| Untrusted model code | Disposable terminal + gVisor |
| Real GPU / lab hardware | BYOS - treat it like prod access |
| Shared expensive machine | BYOS + identity + session recording |
Mediated access is not a jail. Don’t market it as one.
16 · Failures I’ve shipped into
Failures I’ve shipped into
- Docker socket in the “sandbox” - you moved the gate, you didn’t close it
- Full egress by default - agents phone home; you can’t say which session left
- No concurrency / TTL caps - one thrashing agent OOMs the host
- Prompt as the boundary - UX, not isolation
- gVisor in the README, runc in prod - RuntimeClass theater
17 · Steal this
Steal this
- No agent shell on laptops for secrets / prod paths
- One sandbox per task (or per PR) - then delete
- gVisor or stronger for untrusted agent code
- Egress on purpose; treat DNS as data
- CPU / memory / PID caps + a hard TTL
- Outbound agents over inbound SSH for fleet boxes
- Assume breakout; escalate the rung when the threat model says so
18 · If you remember five things
If you remember five things
- Agent + shell = untrusted RCE with better UX
- Sandbox = create, limit, network, delete - not a system prompt
- Stock containers are not hostile multi-tenant isolation by themselves
- Outbound tunnels beat inbound SSH for real hardware
- TTL and concurrency caps are security features when models thrash
19 · Close
Questions?
Alex Idowu · @nitrocode · Lagos