Summary

Greywall provides a container-free, kernel-enforced sandbox for AI coding agents on Linux and macOS. It mitigates security risks by implementing deny-by-default filesystem, network, and syscall isolation, preventing AI tools from accessing sensitive system resources or data. This allows developers and researchers to safely run untrusted code or AI tools, preventing unauthorized data exfiltration or system modification.

How It Works

Greywall employs container-free, kernel-enforced isolation using Linux features like bubblewrap, Landlock, Seccomp BPF, and eBPF, and macOS's sandbox-exec. A transparent greyproxy routes all network traffic through a dashboard for live control. greywall enforces deny-by-default policies, while greywatch offers permissive observability. A --learning flag traces execution to auto-generate least-privilege profiles.

Quick Start & Requirements

Installation is via Homebrew (macOS), a shell script, or Go. Linux requires bubblewrap and socat; greyproxy is a dependency. Building from source or using mise are alternatives. Full documentation: https://docs.greywall.io/greywall.

Highlighted Details

• Deny-by-default: Restricts filesystem access to the working directory and blocks network connections unless explicitly permitted.
• Agent Profiles: Pre-built configurations for numerous AI coding agents (e.g., Claude Code, Cursor, Copilot) and toolchains simplify setup.
• Learning Mode: Traces filesystem access via strace (Linux) or eslogger (macOS, requires sudo) to auto-generate least-privilege profiles.
• Observability Mode (greywatch): Runs agents with permissive settings and logs all network activity via greyproxy for security analysis.
• Command Blocking: Prevents execution of dangerous commands like rm -rf /.
• Linux Security Layers: Utilizes five distinct kernel-level security mechanisms for robust isolation.

Maintenance & Community

The project is a fork of Fence, originally developed at Tusk AI, Inc. No specific details regarding active maintainers, community channels (like Discord/Slack), or sponsorships are provided in the README.

Licensing & Compatibility

Greywall is licensed under the Apache License 2.0. This license is permissive and generally compatible with commercial use and integration into closed-source projects.

Limitations & Caveats

Transparent network proxying and DNS capture are Linux-specific features, relying on TUN/tun2socks. macOS lacks these full traffic capture capabilities. macOS learning mode requires sudo privileges. Optional Linux dependencies exist for D-Bus proxying.