This is really interesting. I built a similar product (not released yet), but it uses Kubernetes as the infrastructure layer instead of Cloudflare OS. I guess all these years later I am left with the same existential question that plagued Sandstorm. What is its relevance in the context of Linux containers? This is not a rhetorical question, is there a real benefit for a Sandstorm grain over a docker style Linux container? Does a containerized process not have all the same benefits of a Sandstorm grain, with the added benefit of not requiring any modifications of the containerized software?

One argument I could bring is that despite all its claims, OpenAI still had to switch from containers to MicroVMs because its agents under test still managed to break out from their containers. Is the security model of a Sandstorm grain so much better that agents wouldn't figure out how to break out of it?

Sandstorm's use of containers was just a means to an end. The real innovation was the fine-grained instances -- each document in its own container. No other container platform did that.

But honestly, it didn't work well, because of cold start times and memory usage. It's bad enough when a server takes seconds to start, but if every document you open has a long startup time and uses hundreds of MB of RAM, it's really painful.

Cloudflare OS doesn't use containers. It uses Dynamic Workers, which are 100x more efficient: https://blog.cloudflare.com/dynamic-workers/

So the stuff I have been building in Workers for the past 9 years turns out to be the thing that Sandstorm needed all along. What a coincidence. :)

I don’t think containers, as normally used, provide that much security because so much of what you want to secure is at the boundaries between containers (the network) rather than inside the container itself.

There’s not much point in preventing hyper visor escape style exploits if the agent can just SSH or psql log in to an adjacent container. Likewise there are near infinite ways to do weird things with the network to make stuff happen in another less controlled environment (eg sign up for AWS free account, make VM, do everything on that VM where controls don’t apply).

There are tools to do this, but I’ve never seen anyone package them up in a way that was pleasant to interact with. It’s got the SELinux problem of being useful, but annoying enough that everyone just disables it the second it gets in the way. It’s surprisingly hard to manage what should be able to connect to what as you start scaling out the number of things on the network. Whoops, you forgot that random software embeds its own DNS over HTTPS resolver so the normal DNS profile won’t work and everything crashed kind of issues.

Linux namespaces, and containers, are not security features in themselves. They end up having to be combined with SECCOMP and some sort of application kernel or SELinux in order to have an effective security apparatus. This is before you give it application aware security controls like policy.

It has real business value. Letting non technical users run wild without the onerous layers of controls in traditional enterprise IT.

We're already contending with users wanting to hook up every SaaS MCP to every other SaaS platform and then slap AI on top. Having a controlled sandbox for that would hugely simplify things.

> is there a real benefit for a Sandstorm grain over a docker style Linux container?

Linux containers are meant to be used by those with significant software engineering skills. Sandstorm was designed to be used, once installed by someone else, by grandma.