Show HN: Sandbox-check – Does your locked-down container reach cloud metadata?

A zero-dependency Go CLI that audits sandbox isolation from inside an AI agent runtime (container, Kubernetes pod, or microVM) — testing whether untrusted code can actually reach cloud metadata endpoints, bypass HTTP_PROXY (UDP DNS, raw TCP, or CONNECT tunneling), SSRF the proxy, hit host services, escape shared kernel surfaces, exhaust unbounded cgroups, or read raw API keys from its environment. The Problem Most sandbox checklists run on the host ("did we pass --cap-drop=ALL?"). Inside real cloud VMs, container-hardening flags and HTTP_PROXY setups still routinely leak cloud IMDS (169.254.169.254), allow raw UDP:53 DNS tunneling, expose host services on the bridge gateway, permit HTTP CONNECT tunnels to localhost/IMDS, or pass raw secrets in process env vars. Humanet sandbox-check tests common escape and exfiltration paths directly from inside the workload and fails closed with deterministic exit codes (0 pass, 2 failure, 3 warnings/inconclusive). Quick Start Install precompiled binary (v0.2.0, SHA256-verified) # Pinned release install (recommended) curl -fsSL https://raw.githubusercontent.com/humanethq/sandbox-check/main/install.sh \ | SANDBOX_CHECK_VERSION=v0.2.0 bash To verify build provenance via GitHub Artifact Attestations (gh CLI required): curl -fsSL https://raw.githubusercontent.com/humanethq/sandbox-check/main/install.sh \ | SANDBOX_CHECK_VERSION=v0.2.0 SANDBOX_CHECK_VERIFY_ATTESTATION=1 bash Or install from source (Go 1.22+): go install github.com/humanethq/sandbox-check/cmd/sandbox-check@v0.2.0 Run inside a sandbox # Human-readable isolation audit report sandbox-check # Structured JSON report (for CI / automated harnesses) sandbox-check --json # Fail closed even on WARN results (treat HTTP 502 proxy errors or unthrottled CPU as exit 2) sandbox-check --strict # Assert cross-tenant isolation against another sandbox IP:port on the same host sandbox-check --peer 10.244.0.15:8080 # Allow direct outbound TCP:443 when public internet access is intentional sandbox-check --allow-public-net Example Output CLI summary (hardened Docker container with default bridge) HUMANET SANDBOX-CHECK v0.2.0 — runtime=docker_container (linux/amd64) uid=65532 pid1="sandbox-check" gw="172.17.0.1" proxy_env=true ====================================================================================== [BASELINE] INFO baseline_network_posture eth0 routed_with_gateway+http_proxy [CLOUD METADATA / IMDS] FAIL imds_aws_gcp_azure_v4 169.254.169.254:80/me... metadata_exposed_http_200 (CRITICAL) -> HTTP GET http://169.254.169.254:80/metadata/instance?api-version=2021-02-01 responded 200 (2129 bytes body omitted) [PROXY BYPASS & DIRECT EGRESS] FAIL bypass_udp53_cloudflare 1.1.1.1:53/udp dns_tunnel_bypass (CRITICAL) FAIL proxy_ssrf_imds_v4 http://169.254.169.2... proxy_ssrf_http_200 (CRITICAL) WARN proxy_ssrf_loopback_docker http://127.0.0.1:2375... proxy_upstream_error_http_502 (CRITICAL) FAIL proxy_connect_imds_v4 CONNECT 169.254.169.... proxy_connect_tunnel_open (CRITICAL) ... SUMMARY: total=40 pass=23 fail=15 warn=1 info=1 skip=0 (critical=7 high=7) RESULT: ISOLATION GAPS DETECTED [verdict=fail] (exit code 2) (When fail=0 and warn>0, sandbox-check explicitly outputs RESULT: WARNINGS DETECTED / INCONCLUSIVE [verdict=warn] (exit code 3), never "NO DETECTED LEAKS".) JSON snippet (--json) { "tool": "sandbox-check", "version": "v0.2.0", "verdict": "fail", "summary": { "total": 40, "passed": 23, "failed": 15, "warned": 1, "info": 1, "skipped": 0, "critical_leaks": 7, "high_leaks": 7 } } What It Checks & Status Semantics 8 Probe Categories Statuses & Exit Codes Platform Support & Kubernetes Usage Ephemeral Kubernetes Pod check Run a temporary SHA256-verified probe pod in the target namespace (linux/amd64): kubectl run sandbox-check --rm -i --restart=Never --image=alpine:3.20 -- sh -ec ' apk add -q --no-cache curl curl -fsSLO https://github.com/humanethq/sandbox-check/releases/download/v0.2.0/sandbox-check-linux-amd64 curl -fsSLO https://github.com/humanethq/sandbox-check/releases/download/v0.2.0/checksums.txt grep "sandbox-check-linux-amd64" checksums.txt | sha256sum -c - chmod +x sandbox-check-linux-amd64 && ./sandbox-check-linux-amd64 ' Or copy the static Linux binary directly into any running pod or container: kubectl cp ./sandbox-check-linux-amd64 my-pod:/tmp/sandbox-check kubectl exec -it my-pod -- /tmp/sandbox-check --json Live Benchmark Snapshot (Cloud Linux KVM Host) Executed sequentially on the same cloud Linux KVM host (linux/amd64, with live link-local cloud metadata on 169.254.169.254). Full methodology, Docker commands, and captured JSON files are in benchmark/REPORT.md. Limitations & Scope refused vs dropped_timeout: When a port is closed on a reachable IP, TCP returns ECONNREFUSED (observed: "refused" -> PASS since nothing answered), whereas a firewall/nftables drop times out (observed: "dropped_timeout"). An in-guest probe cannot prove from timing alone whether a silent drop came from nftables vs blackhole routing — inspect observed carefully alongside host rules. Environment-only secret scope: env_secret_exposure checks process environment variable names (and recognizes phantom prefixes like phm_/phantom_). Credentials stored on disk (~/.aws, ~/.kube, Mounted secrets), Unix socket agents, or custom non-standard env names are out of scope. Workload audit ≠ comprehensive pentest: Passing all sandbox-check probes verifies common guest-observable misconfigurations; it does not prove absence of hypervisor/kernel CVEs, DNS-over-HTTPS abuse via allowlisted domains, or application vulnerabilities, and does not replace an independent penetration test. Built alongside Humanet airgap-check and Frame by Humanet. Development make test # Run unit suite with -race make vet # Run go vet make build # Build local static binary into bin/sandbox-check make release-bins # Cross-compile linux/darwin amd64/arm64 + SHA256 checksums MIT — see LICENSE.