A TypeScript Warden for AI Agents Running Untrusted Code

What it does

Gondolin spawns fast, local Linux micro-VMs (QEMU by default, with an experimental krun backend) to run code that AI agents generate without human review. The host enforces network and filesystem policy through a JavaScript control plane, intercepting HTTP/TLS egress and injecting secrets only for allowlisted destinations. It also supports snapshots, SSH, ingress gateways, and programmable VFS mounts.

The interesting bit

The guest sees only placeholder tokens; the real secret material is grafted onto requests by the host after the guest has already issued them. That means even if the agent’s code is malicious or buggy, the VM cannot leak credentials to arbitrary endpoints because it never possessed them.

Key highlights

• Programmable HTTP/TLS egress filtering and request/response hooks via JavaScript
• Secret injection that keeps real tokens off the guest entirely
• Disk checkpoints with resume support for long-running agent tasks
• Optional experimental krun backend for lighter virtualization
• Custom Alpine-based image builds and configurable rootfs modes (readonly, memory, cow)

Caveats

• The krun backend is explicitly marked experimental and requires additional build dependencies.
• ARM64 is the most tested runtime path; Linux x86_64 coverage is limited to CI smoke builds.
• Guest assets weigh in at roughly ~200MB+ and are cached locally after first resolution.

Verdict

Worth a look if you are building agent frameworks that must execute untrusted code with network access. Skip it if you are already satisfied with container-level isolation or do not need fine-grained, programmable egress control.