arifOS Untrusted Execution Sandbox
Authority
- Owner: Sovereign Architect 888 (Arif)
- Status: ACTIVE
- Deployed: 2026-06-03
Purpose
When an external AI (Copilot, Mythos, or any untrusted synthesizer) generates Python code for arifOS, that code MUST be executed inside a bwrap (Bubblewrap) Supermax jail before it touches any federation organ.
This skill defines both:
- The System Prompt fed to untrusted AI engines
- The Runtime Harness (
arifos-sandbox) that enforces the jail
When to Use
- Generating code from external LLMs (non-arifOS agents)
- Running user-submitted scripts
- Testing AI-generated automation
- Any scenario where code origin is not 100% trusted
When NOT to Use
- Federation agents (arifOS, WEALTH, WELL, GEOX) — these run under systemd hardening, not bwrap
- Internal tool execution — use
arifosmcp.runtime.dispatcher
The System Prompt
See /root/arifOS/prompts/untrusted_execution_synthesizer.txt
Core constraints communicated to the AI:
- UID 65534 (nobody), cap-drop ALL
- Network namespace: loopback exists, zero external routes
- Filesystem: read-only binds, writable only in
/tmp (64MB tmpfs)
- Hard limits: 5 seconds, 128MB RAM
- Python stdlib only, zero third-party imports
- Banned modules: subprocess, os.system, ctypes, socket, urllib, eval, exec, compile, import
- I/O: stdin only in, stdout only out
The Runtime Harness
arifos-sandbox '<python_code>' [timeout] [memory_kb]
Implementation
timeout(1) enforces the seconds limit (SIGKILL)ulimit -v enforces the memory limit (OOM)bwrap provides namespace isolation, capability drop, and filesystem sandboxing- Script is written to ephemeral temp file, destroyed after execution
bwrap flags used
--ro-bind /usr /usr
--ro-bind /lib /lib
--ro-bind /lib64 /lib64
--proc /proc
--dev /dev
--size 67108864 --tmpfs /tmp
--unshare-all
--die-with-parent
--new-session
--cap-drop ALL
--setuid 65534
--setgid 65534
--dir /run/user
F1–F13 Alignment
| Floor |
Compliance |
| F1 |
Capability drop + namespace isolation = no privilege escalation |
| F2 |
Prompt accurately reflects runtime reality (loopback truth, timeout truth) |
| F4 |
Single-threaded, stdlib-only = consistent execution environment |
| F7 |
5s/128MB bounds prevent resource exhaustion |
DITEMPA BUKAN DIBERI
1---2name: arifos-untrusted-sandbox3description: Mandatory bubblewrap (bwrap) supermax jail for executing any untrusted Python/JS synthesized by external AIs (Copilot, Mythos, third-party). Load when running, evaluating, or testing code from non-federation AI sources. Triggers on `exec(`, `eval(`, untrusted code review, jail requirement.4---56# arifOS Untrusted Execution Sandbox78## Authority9- **Owner:** Sovereign Architect 888 (Arif)10- **Status:** ACTIVE11- **Deployed:** 2026-06-031213## Purpose14When an external AI (Copilot, Mythos, or any untrusted synthesizer) generates Python code for arifOS, that code MUST be executed inside a `bwrap` (Bubblewrap) Supermax jail before it touches any federation organ.1516This skill defines both:171. The **System Prompt** fed to untrusted AI engines182. The **Runtime Harness** (`arifos-sandbox`) that enforces the jail1920## When to Use21- Generating code from external LLMs (non-arifOS agents)22- Running user-submitted scripts23- Testing AI-generated automation24- Any scenario where code origin is not 100% trusted2526## When NOT to Use27- Federation agents (arifOS, WEALTH, WELL, GEOX) — these run under systemd hardening, not bwrap28- Internal tool execution — use `arifosmcp.runtime.dispatcher`2930## The System Prompt3132See `/root/arifOS/prompts/untrusted_execution_synthesizer.txt`3334Core constraints communicated to the AI:35- UID 65534 (nobody), cap-drop ALL36- Network namespace: loopback exists, zero external routes37- Filesystem: read-only binds, writable only in `/tmp` (64MB tmpfs)38- Hard limits: 5 seconds, 128MB RAM39- Python stdlib only, zero third-party imports40- Banned modules: subprocess, os.system, ctypes, socket, urllib, eval, exec, compile, __import__41- I/O: stdin only in, stdout only out4243## The Runtime Harness4445```bash46arifos-sandbox '<python_code>' [timeout] [memory_kb]47```4849### Implementation50- `timeout(1)` enforces the seconds limit (SIGKILL)51- `ulimit -v` enforces the memory limit (OOM)52- `bwrap` provides namespace isolation, capability drop, and filesystem sandboxing53- Script is written to ephemeral temp file, destroyed after execution5455### bwrap flags used56```57--ro-bind /usr /usr58--ro-bind /lib /lib59--ro-bind /lib64 /lib6460--proc /proc61--dev /dev62--size 67108864 --tmpfs /tmp63--unshare-all64--die-with-parent65--new-session66--cap-drop ALL67--setuid 6553468--setgid 6553469--dir /run/user70```7172## F1–F13 Alignment7374| Floor | Compliance |75|-------|------------|76| F1 | Capability drop + namespace isolation = no privilege escalation |77| F2 | Prompt accurately reflects runtime reality (loopback truth, timeout truth) |78| F4 | Single-threaded, stdlib-only = consistent execution environment |79| F7 | 5s/128MB bounds prevent resource exhaustion |8081## DITEMPA BUKAN DIBERI
ariffazil