Agent Sandboxes Need Undo Buttons, Not Just Walls

·https://github.com/abshkbh/arrakis
repoaiinfrastructuresandboxingmicrovmgomcpagent-loopsworkflow-rigsnapshotscomputer-useself-hosting

Arrakis is a clean reference for making joelclaw agent workloads rewindable: MicroVM isolation plus snapshot/restore exposed through REST, Python, and MCP.

Arrakis is a Go service for running agent sandboxes as cloud-hypervisor MicroVMs, with an Ubuntu guest, command execution, VNC, Chrome for computer use, a REST API, py-arrakis, and an MCP server. It’s Linux only because cloud-hypervisor needs /dev/kvm. That constraint is a feature, not a cute abstraction leak: this is a real machine boundary, not another Docker wrapper pretending hostile code is fine.

The clever bit is undo. Agents make plans, mutate state, spawn processes, and then discover the path was trash. Arrakis snapshots and restores the whole sandbox so a client can checkpoint a MicroVM, wreck it, destroy it, and come back to the exact earlier state. That maps cleanly to Monte Carlo Tree Search, agent explainability, and boring-but-useful reviewer loops where you want proof of what changed instead of vibes.

For joelclaw, the interface shape is the thing to steal: lifecycle, file upload, command execution, GUI port metadata, and snapshots exposed through REST, Python, and Model Context Protocol. I wouldn’t drop it in blindly: AGPL-3.0, iptables, root needs, Linux KVM, and host port forwarding all matter. But the agent-facing seam is sharp as hell.

Key Ideas

Links

← All discoveries