DEV Community

Isolating Autonomous AI Coding Sandboxes & Fixing Tailscale Subnet Collisions (nftables, macOS pf, 4via6 & MCP)

Autonomous AI coding agents (Claude Code, Cursor background agents, containerized SWE sandboxes) are increasingly given raw shell execution inside cloud VMs, Docker containers, or Tailscale-joined workstations. Left unguarded, two predictable failure modes show up fast:

  • AI Sandbox SSRF & Lateral Movement: An unisolated coding agent can query cloud instance metadata (169.254.169.254 / fd00:ec2::254) to harvest IAM credentials, probe private 192.168.0.0/16 or 100.64.0.0/10 peers over TCP :22 SSH / :2375 Docker / :5432 Postgres, or collide on shared Tailscale NodeKey state across container restarts.
  • RFC 1918 Wi-Fi Collisions & Selective QUIC Stalls: Advertising raw /24 LAN routes over Tailscale breaks silently whenever a hotel or coffee-shop Wi-Fi shares your home prefix, while throttled UDP/443 proxy tunnels in Sing-box or Mihomo stall Apple Media and mobile Gmail fetches for 50 seconds - yet blocking UDP/443 globally breaks YouTube mobile (Cronet HTTP/3) captions.

To eliminate these failure modes deterministically across Linux, macOS, and Tailscale without external dependencies, I built and open-sourced StarHub Kit (v1.3.0) - a zero-dependency Python 3.9+ policy compiler and native Model Context Protocol (MCP) server certified Linux Foundation OpenSSF Best Practices Silver (#16658) with SLSA Build Level 3 provenance.

Turnkey Autonomous AI Agent Sandbox Isolation

Instead of hand-maintaining brittle firewall shell scripts across OSes, a single declarative topology (profiles/topology.ai-sandbox.json) compiles into Linux nftables (inet), macOS pf anchors, Tailscale ACL HuJSON, and dual-stack iptables / ip6tables (--target all):

  • Hard-drops cloud metadata SSRF (169.254.169.254/32 and fd00:ec2::254/128);
  • Rejects inbound/lateral TCP :22 SSH over both IPv4 and IPv6 (STARHUB-BOT-NOSSH / NOSSH6) while isolating per-sandbox Tailscale state directories;
  • Permits only explicitly declared upstream API endpoints before dropping remaining RFC 1918 and CGNAT lateral traffic.

Eliminating Subnet Collisions & Cross-Engine QUIC Guardrails

  • Zero Subnet Collisions: Containers join Tailscale natively on 100.64.0.0/10, while non-Tailscale hypervisors map through stateless Tailscale 4via6 IPv4-to-IPv6 translation with an automatic STARHUB-IPV6-EXIT-GUARD leak-prevention chain.
  • Selective QUIC (UDP/443) & Deterministic Split-DNS: Compiles matching rulesets for both Sing-box (v1.11+ rule actions) and Mihomo, rejecting UDP/443 only for stalled Apple/Gmail endpoints so clients fall back to TCP/TLS in <50 ms while keeping YouTube HTTP/3 untouched.

10-Second Unprivileged Preview & Zero-Dependency MCP Server

Every target supports non-root --dry-run preview directly to stdout, static risk auditing (starhub audit), and a built-in stdio MCP server (starhub mcp) for Claude Code, Cursor, or Windsurf:

# Install via Homebrew Tap (macOS / Linuxbrew):
brew install Ziqi/tap/starhub-kit

# Preview Linux nftables, macOS pf, Tailscale ACL & Sing-box rules with zero root or disk writes:
starhub render --profile ai-sandbox --target all --dry-run
starhub audit

# Or run directly via Nix Flakes without installing:
nix --extra-experimental-features 'nix-command flakes' run github:Ziqi/starhub-kit -- \
  render --profile ai-sandbox --target nftables --dry-run

Before publishing configs, starhub doctor --verify-public-export scans your working tree and Git history to verify zero private IPs, tailnet names, or keys leak into public commits.

Read on DEV Community ↗ ← Back to News

Comments

No comments yet. Start the discussion.