Skip to main content
Palyra implements a multi-layered security model for executing untrusted code and tools. This architecture is divided into three distinct Execution Tiers, ranging from high-performance in-process isolation to kernel-level sandboxing. Each tier provides different trade-offs between overhead, compatibility, and security posture.

Overview of Sandbox Tiers

The system classifies execution into three tiers (A, B, and C). The selection of a tier is governed by the SandboxProcessRunnerPolicy crates/palyra-daemon/src/sandbox_runner.rs#81-93 and the specific requirements of the tool being executed.
TierTechnologyIsolation LevelPrimary Use Case
Tier-AWasmtime (WebAssembly)Software-defined (SFI)High-density plugins, Skills, and portable logic.
Tier-BUnix rlimit / In-processResource-constrained processLegacy Unix-style resource quotas (CPU/Memory).
Tier-COS-Native (bwrap/sandbox-exec)Kernel-level namespacesArbitrary binary execution with filesystem/network jails.

Sandbox Architecture Data Flow

The following diagram illustrates how a tool call is routed through the policy engine and dispatched to the appropriate sandbox tier. Tool Execution and Sandboxing Flow

Tier-A: Wasm Runtime (wasmtime)

Tier-A execution uses wasmtime to provide a high-performance, secure sandbox for WebAssembly modules. This is the primary execution environment for Skills and inline plugins.

Implementation Details

Guardrails


Tier-B: Unix rlimit In-Process

Tier-B provides a lightweight isolation layer for Unix-like systems. It relies on standard process resource limits (rlimit) to constrain CPU time and memory usage.

Key Characteristics


Tier-C: OS-Native Sandboxing

Tier-C is the most restrictive tier, using platform-specific kernel features to create an isolated execution environment.

Backend Implementation

The palyra-sandbox crate abstracts the platform-specific backends:
  • Linux: Uses bubblewrap (bwrap) to create mount namespaces, PID namespaces, and network unsharing crates/palyra-sandbox/src/lib.rs#105-184.
  • macOS: Uses sandbox-exec with a generated Scheme profile.
  • Windows: Uses Job Objects for resource accounting and restriction.

Command Planning

The build_command_plan function transforms a generic TierCCommandRequest into a platform-specific execution plan crates/palyra-sandbox/src/lib.rs#86-91. Tier-C Command Construction (Linux Example)

Egress and Workspace Enforcement

Security is enforced not just through isolation, but through strict validation of inputs and outputs.

Egress Enforcement Modes

Controlled by EgressEnforcementMode crates/palyra-daemon/src/sandbox_runner.rs#47-51:
  1. None: No egress restrictions.
  2. Preflight: Validates requested hosts against an allowlist before execution.
  3. Strict: Enforces network isolation at the sandbox level (e.g., --unshare-net in bwrap) crates/palyra-sandbox/src/lib.rs#176-178.

Workspace Scope Validation

Before execution, the runner validates that all file paths and arguments stay within the authorized workspace:

Interpreter Guardrails

To prevent shell injection and escape, the system implements an INTERPRETER_EXECUTABLE_DENYLIST crates/palyra-daemon/src/sandbox_runner.rs#30-44. This prevents tools from accidentally or maliciously spawning shells like bash, powershell, or python unless explicitly allowed by the policy allow_interpreters crates/palyra-daemon/src/sandbox_runner.rs#86.

Resource and Output Budgets

To prevent “denial of service” via logs or infinite loops, the sandbox enforces strict budgets:
Budget TypeDescriptionImplementation
Execution TimeoutTotal wall-clock time allowed for the process.execution_timeout crates/palyra-daemon/src/sandbox_runner.rs#150.
Output BudgetMaximum bytes allowed for combined stdout/stderr.max_output_bytes crates/palyra-daemon/src/sandbox_runner.rs#92.
Fuel BudgetDeterministic instruction count (Tier-A only).fuel_budget crates/palyra-plugins/runtime/src/lib.rs#25.

Output Enforcement

The execute_process function captures streams using a StreamCapture struct crates/palyra-daemon/src/sandbox_runner.rs#141-145. If the cumulative bytes exceed max_output_bytes, the process is immediately terminated with a QuotaExceeded error crates/palyra-daemon/src/sandbox_runner.rs#219-227.

Sources

  • crates/palyra-daemon/src/sandbox_runner.rs 1-235
  • crates/palyra-daemon/src/tool_protocol.rs 19-186
  • crates/palyra-daemon/src/wasm_plugin_runner.rs 18-126
  • crates/palyra-sandbox/src/lib.rs 7-200
  • crates/palyra-plugins/runtime/src/lib.rs 23-186
  • crates/palyra-policy/src/lib.rs 11-218