Airlock – container agents should never hold credentials

Name: Airlock – container agents should never hold credentials
Availability: InStock
Author: kalib_tweli

by kalib_tweli·Mar 18, 2026·2 points·0 comments

Visit Project View on HN

AI Analysis

●●SolidBig BrainNiche Gem

Host-side credential enforcement for containerized agents before they leak your AWS keys.

Strengths

•Busybox-style single binary shim reads argv[0] to proxy any CLI tool
•TOML command modules with conservative deny rules reject unknown commands
•Unix socket communication means credentials never touch the container filesystem

Weaknesses

•Zero stars and forks — very early with no community validation yet
•Homebrew PATH issues on macOS require manual configuration workarounds

Post Description

I built Airlock to move policy enforcement for credentialed CLI access out of agent containers and onto the host.

In Dockerized agent setups, prompt files, skills, and other in-container controls are not a real boundary. The agent can ignore or rewrite them.

Airlock replaces sensitive CLIs in the container with shims that send requests to a host daemon over a Unix socket. The host validates the request against policy and, if allowed, executes the real command there.

The goal is to let a containerized agent use tools like git, ssh, aws, terraform, or docker without the container holding the real credentials.

It’s not a general sandbox or a complete agent security solution. It solves a narrower problem: host-side enforcement for credentialed CLI access.