A Short Leash for AI Coding Agents

What it does ai-jail is a Rust wrapper that launches AI agents like Claude Code and GPT Codex inside OS-native sandboxes. On Linux it uses bubblewrap (bwrap); on macOS it relies on the legacy sandbox-exec interface. By default, only the current project directory persists; parent directories, siblings, $HOME, and /tmp are mounted as tmpfs and vanish when the process exits. A per-project .ai-jail config file defines the policy, and the tool auto-hides that config from the agent so it cannot read its own rules.

The interesting bit Most security tools treat usability as the enemy, but ai-jail’s default mode is designed for agents: it mounts agent state directories like ~/.claude read-write so logins and settings survive, while explicitly hiding sensitive dotdirs such as ~/.ssh and ~/.aws. It also supports glob-based masking and denials (--mask '**/*.env'), and can even replace /etc/machine-id with an empty file to reduce hardware fingerprinting. The README is admirably frank about the trade-offs—default mode inherits your shell environment and display sockets, so tokens and IPC are still visible inside the cage.

Key highlights

• Cross-platform sandboxing: bubblewrap on Linux, sandbox-exec on macOS
• Filesystem containment: only the project directory is persistent by default; everything else is tmpfs
• Secret masking: glob patterns can hide .env, credentials, or the entire .ai-jail policy file from the agent
• Docker socket access is opt-in and explicitly flagged as dangerous (trivial sandbox escape via host bind mounts)
• Auto-detects Git worktrees and exposes their external admin directories safely

Caveats

• The authors explicitly state it is not 100% secure; default mode favors usability over maximum lockdown
• Linux users on Ubuntu 24.04+ and Debian 13+ may hit AppArmor restrictions that block bubblewrap unless they relax the policy
• macOS support depends on sandbox-exec, which Apple has deprecated

Verdict Worth a look if you run AI agents on real codebases and want sensible guardrails without re-imaging your laptop. Skip it if you need a hardened, audited isolation layer or if you refuse to maintain a per-project sandbox policy.