Ukwenza i-sandbox ngesandla ngaphandle kwesofthiwe eyengeziwe ezindaweni zangempela

Uma usebenza nesofthiwe, ama-ejenti e-AI, noma amafayela alandiwe ku-inthanethi, enye yezinto ezivame ukwesatshwa yilokhu Ukuphula okuthile ohlelweni lwakho, ukutheleleka yi-malware, noma ukuvuza idatha ebucayi Cishe ngaphandle kokuqaphela. Akudingeki ube novalo: ukwehluleka okukodwa kokusebenzisa kungasusa isizindalwazi, konakalise ukuthunyelwa, noma kuthelele uhlelo lwakho nge-malware.

Izindaba ezinhle ukuthi namuhla unezindlela eziningana zokwenza eyodwa ongazisebenzisa. indawo ehlukanisiwe lapho ungazama khona izinto ngaphandle kokuthatha izingoziFuthi eziningi zazo zihlanganiswe ohlelweni lokusebenza ngokwalo noma kumapulatifomu aklanyelwe ama-ejenti ekhodi. Lokhu sikubiza ngokuthi "i-sandboxing": ukusebenzisa ikhodi ngaphakathi kohlobo lwebhamuza elilawulwayo, ukuze noma ngabe kukhona okungahambi kahle noma okunonya, umonakalo uvinjelwe.

Kuyini ukwenza i-sandboxing ngesandla ngaphandle kwesofthiwe eyengeziwe?

Ekuphepheni nasekuthuthukisweni, ukukhuluma ngamabhokisi esihlabathi kusho ukukhuluma... ukuchaza ngokucacile lokho uhlelo noma i-ejenti engakuthinta ngenkathi isebenzaAkukhona nje kuphela "ukuyisebenzisa kwenye indawo," kodwa mayelana nokuchaza imingcele ecacile: ukuthi yimaphi amafayela engawabona, yiziphi izinqubo engaziqalisa, ukuthi inanethiwekhi yini, yiziphi iziqinisekiso engazisebenzisela, ukuthi leyo ndawo ihlala isikhathi esingakanani, nokuthi kwenzekani esimweni sayo lapho iphela.

Umehluko phakathi "kokusebenzisa ngesandla" kanye "nangaphandle kwesofthiwe eyengeziwe" uyadukisa. Ezimweni eziningi, ungathembela ku imisebenzi esivele ifakiwe ohlelweni lwakho lokusebenza noma epulatifomu yakho yokuthuthukisanjenge-Windows Sandbox, ama-Linux primitives (i-Landlock, i-seccomp), noma ama-macOS mechanisms. Awudingi ukufaka i-virtualization suite ephelele, kodwa udinga ukufunda ukuthi ungayenza kanjani sebenzisa futhi uphathe lezo zindlela ezihlanganisiwe ukusebenza njengesithiyo phakathi kwekhodi ofuna ukuyihlola nomshini wakho wangempela.

Kungani ama-ejenti ekhodi edinga izindawo ezihlukanisiwe?

Ama-ejenti okubhala amakhodi esimanje awasewona abasizi abalula abanjengokuxoxa abaphakamisa izingcezu zekhodi: ayiwo izindawo zokwenza izinto ezihlanganiswe nemodeli yolimiBangafunda indawo yakho yokugcina, bahlele amafayela, basebenzise imiyalo yesiphelo, faka amaphakheji, yakha izitsha, khuluma nama-API angaphandle ngisho namaseshini esiphequluli avulekile.

Amapulatifomu afana neClaude Code, amanye ama-"Deep Agents" eLangChain noma ama-sandbox athile asatshalaliswa yi-Docker namanye amathuluzi achaza ngokucacile ukuthi lawa ma-ejenti Basebenza ezinhlelweni zamafayela zangempela, baqalise izingxoxo, futhi banikeze imisebenzi kuma-sub-ejenti akhethekile.Ngamanye amazwi, zifana kakhulu nonjiniyela omncane onokufinyelela kumathuluzi akho... ngokuzenzakalela futhi kuyashesha kakhulu.

Kulowo mongo, umbuzo oyinhloko wokuphepha awusabi ukuthi "Ingabe uphendula kahle esicelweni?" bese uba: "Iyini imingcele uma ingalungile, iqondiswe kabi, noma ishintshiwe?"Uma imodeli ingakwazi, isibonelo, ukusebenzisa i-pytest, ukufaka amaphakheji e-npm, ukuphatha amagatsha, noma ukuhlola ukwehluleka kokuhlanganiswa, kuseduze nje nokuthinta izikripthi zokuthunyelwa, ukuguqula ama-Git hooks, noma ukukhipha izimfihlo kusevisi ekude.

Impendulo elula ivame ukudinga imvume yomuntu kuyo yonke imiyalo. Lokho kuyasiza, kodwa kunenkinga ephindaphindayo: ukukhathala kokuvumaEzindaweni lapho onjiniyela bethula khona ama-ejenti amaningi noma imisebenzi yokusebenza ngesikhathi esifanayo, inani elikhulu lezicelo livame ukuholela ekutheni cishe konke kuvunyelwe ngaphandle kokubuyekezwa ngokucophelela. Lapho izicelo zemvume ezingaphezu kuka-90% zamukelwa ngokuzenzakalelayo, le ndlela ayibe isasebenza njengokulawula ukuphepha kwangempela futhi iba nje inqubo evamile.

Yingakho ama-sandbox ebaluleke kangaka: Abenzi imodeli ibe ngengenaphutha, futhi abalungisi ukujovwa kwemiyalelo.Kodwa ziyanciphisa "i-blast radius" yamaphutha ayo. Uma i-AI iphazamisa noma othile ephumelela ukuduna imiyalelo yayo, umonakalo uhlala uvaleleke endaweni ehlukanisiwe esikhundleni sokusabalala ngqo ohlelweni lwakho lokukhiqiza noma kwi-laptop yakho.

Imikhawulo eyinhloko yebhokisi le-sandbox le-ejenti yekhodi

Ibhokisi lesanti elingathi sína lama-ejenti okubhala amakhodi lincike ezinhlotsheni eziningana zemingcele, hhayi nje "esinye isiqondisi" noma "esinye isitsha." Ngayinye imboza isici esihlukile sengozi, futhi ukuyiqonda kubalulekile ukuze ubhale i-sandbox ngesandla ngempumelelo ngezinsiza zakho ezikhona.

Umngcele wesistimu yefayela

Into yokuqala ukunquma. yimuphi umuthi wesikhombisi ongabonwa futhi ulungiswe yi-ejentiKu-sandbox elungiselelwe kahle, i-ejenti kufanele ikwazi ukufunda nokubhala kuphela endaweni yokusebenza noma amavolumu owakhayo ngokucacile. Okunye kohlelo (uhla lwemibhalo yasekhaya lomsebenzisi, izindlela zohlelo, amanye amaphrojekthi) akufanele kufinyeleleke kulo.

Izinhlaka zama-ejenti kanye namapulatifomu e-sandbox zikwenza kucace kakhulu: i-sandbox iyi- isithiyo esivimbela ukuthinta amafayela e-host ngale kwalokho okwabiweKumamodeli asekelwe ku-microVM, umthetho uqine nakakhulu: kuphela i-directory oyifake (evame ukufunda nokubhala) ewela umngcele phakathi komshini obonakalayo kanye ne-host. Konke okunye akutholakali ngaphandle kokuthi uyivule.

Umngcele wenqubo kanye ne-kernel

Umngcele wesibili oyisihluthulelo yilokho i-ejenti ekubonayo ezingeni lenqubo kanye ne-kernel. Uma kungaphakathi kwendawo ehlukanisiwe ukufaka amasevisi, ukuqala izitsha, noma ukuqalisa imicuZonke lezi zenzo kumele zihlale zihlanganisiwe, ngaphandle kwezinqubo zokwabelana noma i-kernel engenalutho nomsingathi.

Ukuqaliswa okuningi kwe-sandbox okuqinile kuncike kukho ama-microVM noma imishini ebonakalayo elula nge-kernel yabo ye-Linux, eqiniswe ngama-seccomp, ama-cgroup, izikhala zamagama, kanye namasu e-jail. Abanye basebenzisa izendlalelo ezifana ne-gVisor noma i-Kata Containers ukuze bahlanganise ungqimba lwe-virtualization noma i-emulation phakathi kwenqubo ehlukanisiwe kanye ne-kernel ye-node. Umqondo oyisisekelo: uma othile esebenzisa okuthile ngaphakathi, ukugxuma uye ku-host kunzima kakhulu kunasesitsheni esilula se-shared-kernel.

Umngcele wenethiwekhi

Ama-ejenti ekhodi avame "ukulambela inethiwekhi" kakhulu: afuna ukufaka izinto ezixhomeke kuzo, ahlole amadokhumenti, ashayele ama-API e-LLM, afinyelele ezindaweni zokugcina ezikude, noma aphequlule iwebhu. Ngaphandle kwenqubomgomo ecacile, indawo "ehlukanisiwe" ingagcina iyinto umhubhe omuhle kakhulu wokukhipha idatha.

Yingakho amapulatifomu amaningi ethatha isimo sokuthi ukwenqatshwa okuzenzakalelayo kwethrafikhi ephumayoI-HTTP/HTTPS ivinjiwe ngaphandle kwezimo ezithile, i-TCP/UDP/ICMP ivinjelwe, futhi, okubaluleke kakhulu, ukufinyelela kumabanga ayimfihlo namakheli endawo akuvunyelwe. Ukuxhumana kuvunyelwe kuphela ngama-host noma ama-domain afakwe ngokusobala ohlwini lwabavunyelwe, futhi ngokuvamile nge-proxy elawulwa yi-host.

Umkhawulo weziqinisekiso

Akusizi ngalutho ukuba i-ejenti ivalelwe phansi uma, ngaphakathi kwekheji layo, ingafunda okhiye bakho be-API, amathokheni okuthunyelwa, noma izimfihlo zedathabheyisi. Umklamo wanamuhla wama-sandbox amaningi uqukethe... Ungalokothi ufake izimfihlo ezingavuthiwe endaweni ehlukanisiweEsikhundleni salokho, yiba ne-proxy ku-host engeza iziqinisekiso kuma-header ezicelo ze-HTTP i-sandbox efuna ukuzithumela.

Ngale ndlela, inqubo ngaphakathi kwebhokisi lesanti Usebenzisa iziqinisekiso kodwa akaze azibone.Lokhu kunciphisa kakhulu umthelela wokubanjwa kwe-ejenti okungenzeka. Kodwa-ke, lapho ugcina ukhiye kufayela noma endaweni eguquguqukayo ngaphakathi kwebhokisi lesanti, lelo thuba liyanyamalala: imodeli ingayifunda ngqo, futhi noma yikuphi ukufakwa kwemiyalelo kungayala ukuthi iwuhlunge.

Umngcele womjikelezo wokuphila kanye nesifundazwe

Ekugcineni, kukhona umkhawulo wesikhathi: Yini elondolozwayo nokuthi yini ebhujiswayo lapho imvelo imaAma-ejenti awawona ama-process ayenzeka kanye kuphela: afunda, ahlanganisa, alungisa amaphutha, avula imibono eminingana, alahle eminye, aqalise kabusha eminye... Lokhu kudinga isikhathi sokusebenza esiphatha isimo ngobuhlakani: ukuqala okusheshayo, ukumiswa, izithombe, ukuhlanganisa, kanye nokususa okuphephile.

Ezinye izinkundla zinikeza izithombe zememori, amachibi ezindawo ezishisiwe, kanye nemisebenzi yokubopha kusuka esimweni esithile (isibonelo, isiphequluli esivele siqinisekisiwe noma igrafu yokuxhomekeka exazululwe kancane). Lokhu kwenza umehluko phakathi kwe-ejenti esebenzisekayo—leyo engakwazi ukuphindaphinda ngokuxhumana—kanye ne-ejenti ethatha isikhathi ukuphinda isethaphu esifanayo ngokuphindaphindiwe.

Ukuqaliswa kwe-Sandboxing ku-macOS, Linux, kanye ne-Windows

Ngaphandle kwemikhiqizo yezentengiselwano, amaqembu amaningi akhethe sebenzisa amathuba okuqala okuhlukaniswa asevele ekhona ezinhlelweni zokusebenza ukwakha ama-sandbox e-code agent yabo ngaphandle kokwengeza izendlalelo ezisindayo. Isihluthulelo ukuqonda ukuthi ipulatifomu ngayinye iletha ini etafuleni.

I-Sandboxing ku-macOS: Ibhande Lokuphepha kanye namaphrofayili ashukumisayo

Amamodeli amaningana ahlolwe ku-macOS: I-App Sandbox, ama-container, imishini ebonakalayo, kanye ne-Seatbelt. Izinketho zokuqala zinezinkinga ezinkulu endaweni yokuthuthukiswa: I-App Sandbox idinga ukusayina yonke i-binary engase isetshenziswe yi-ejenti futhi izuza njengefa ukwethenjwa kwenkampani, okuvula izimbangela zokuhlukunyezwa uma i-ejenti ngokwayo ikhiqiza noma iguqula ama-binary; iziqukathi zikhawulelwe ku-ecosystem ye-Linux; ama-VM endabuko aneza ukubambezeleka okukhulu kokuqalisa kanye nokusetshenziswa kwememori.

Enye indlela ewusizo kube ukuthembela ku- Ibhande lesihlalo, elifinyeleleka kalula nge-sandbox-execNakuba i-Apple ibilokhu iyiphawula njengengasebenzi iminyaka eminingi, isasetshenziswa izinhlelo zokusebenza ezibalulekile ezifana ChromeIkuvumela ukuthi usebenzise imiyalo ngaphansi kwephrofayili ye-sandbox ekhawulela ukuziphatha kwesihlahla senqubo yonke yenzalo.

Leyo phrofayela ichaza izimvume ngobuningi obukhulu: Ingahlunga ama-syscall athile futhi ifunde noma ibhale kumafayela athile kanye nezinhlu zemibhalokusetshenziswa ulimi lwenqubomgomo olungavamile. Kukhona ukusetshenziswa okudala le nqubomgomo ngokuguquguqukayo ngesikhathi sokusebenza, okuhlanganisa ukucushwa kwendawo yokusebenza, izinqubomgomo zomphathi, kanye namafayela anganakwa ngumsebenzisi, ukuze i-ejenti ibe nendawo yokushintsha ngaphandle kokuthinta izindawo eziyingozi.

I-Sandboxing ku-Linux: I-Landlock kanye ne-seccomp

I-Linux inikeza kokubili ukuguquguquka okwengeziwe kanye nomsebenzi owengeziwe: i-kernel iveza izinto zokuqala ezifana I-Landlock kanye ne-seccompKodwa kungumthwalo wemfanelo wendawo yomsebenzisi ukuzihlanganisa zibe yi-sandbox eqondakalayo nephathekayo.

Esikhundleni sokuthembela kuphela kumaphrojekthi angaphandle, amanye amaqembu akhetha ukwenza kanjalo Sebenzisa i-seccomp ngqo ukuvimba izingcingo zesistimu ezibhekwa njengeziyingozi. kanye ne-Landlock ukuze kuvinjelwe ukufinyelela ohlelweni lwamafayela. Iphethini evamile ihilela ukufaka indawo yokusebenza yomsebenzisi phezu kwesembozo sesistimu yamafayela kanye Shintsha amafayela amakwe njenganganakwa ngamakhophi akhethekile avikelwe yi-Landlockukuze inqubo ehlukanisiwe ingakwazi ukufunda noma ukuguqula noma yini ofuna ukuyifihla ngempela.

Ingxenye ehamba kancane yale ndlela ivame ukuthola nokuhlanganisa kabusha wonke lawo mafayela, njengoba I-Linux ayinikezi indlela elula yokuthola indlela ephelele yefayela ngaphakathi kwesihlungi se-seccomp-bpfNoma kunjalo, umphumela uba ibhokisi lesihlabathi elihle impela: i-ejenti ingasebenza nomuthi wayo wephrojekthi kuyilapho izindlela ezingavunyelwe, empeleni, zingaphandle kwendawo yayo yonke.

I-Sandboxing ku-Windows: ukuthembela ku-WSL2

Ku-Windows, indaba ihlukile. Ukudala i-sandbox yendabuko esetshenziswa kabanzi kuyinkimbinkimbi kakhulu ngoba Iningi lama-primitive okuhlukaniswa akhona aklanyelwe iziphequluli noma enye isofthiwe ethile kakhulufuthi azihambisani kahle namathuluzi okuthuthukisa ahlukahlukene.

Isixazululo esisebenzayo yilesi sebenzisa i-sandbox ye-Linux ngaphakathi kwe-WSL2Ngale ndlela, uphinda usebenzise amathuluzi okuzihlukanisa e-Linux (i-Landlock, i-seccomp, izikhala zamagama, njll.) kwisisekelo se-virtualization esihlukanisa iseshini yokuthuthukisa kusuka kumphathi we-Windows. Ngesikhathi esifanayo, kunomsebenzi ohlanganisiwe ne-Microsoft wokudalula izinto ezintsha ezizogcina zivumele i-sandboxing eyengeziwe yamathuluzi okuthuthukisa.

I-Windows Sandbox: isikhala esihlukanisiwe esihlanganiswe ohlelweni

Kulabo abasebenzisa i-Windows 10 noma i-11 kuzinhlelo ze-Pro, Enterprise noma Education, kukhona ithuluzi elithakazelisayo kakhulu: I-Sandbox yamaWindowsKungumshini obonakalayo olula ohlanganiswe ohlelweni ngokwalo olukuvumela ukuthi usebenzise izinhlelo zokusebenza ezingathembekile noma amafayela asolisayo endaweni engasetshenziswa kalula.

Umqondo ulula: uma uvula i-Windows Sandbox, iyaqala ideskithophu yesikhashana, ehlanzekile yeWindows, njengokungathi isanda kufakwaKonke okukopishayo noma okufakayo ngaphakathi kukho—izinhlelo, amadokhumenti, izikripthi—kukhona kuphela kuleso simo. Uma uvala ifasitela, indawo iyabhujiswa: isofthiwe, amafayela, kanye nesimo kuyalahlwa, futhi ngesikhathi esizayo lapho uqala kusukela ekuqaleni.

Izici ezibalulekile ze-Windows Sandbox

Lesi sici siza nezakhiwo eziningana eziwusizo kakhulu ze-sandboxing ngesandla ngaphandle kokuthembela kumathuluzi avela eceleni:

• Ingxenye yeWindowsKonke okudingayo sekufakiwe kakade ezinhlelweni ezihambisanayo (Pro, Enterprise, Education). Akudingeki ukuthi ulande izithombe noma unakekele imishini yangaphandle ebonakalayo.
• Iyalahleka futhi ihlanzekileUkusebenza ngakunye kuhlanzekile njengokufakwa kweWindows okusha. Akukho lutho olwenzayo ngaphakathi olugcinwa kudivayisi yakho uma usuvale indawo.
• Kuphephile ngomklamoIthembele ku-virtualization esekelwa yihadiwe (i-Hyper-V) ukuze ihlukanise i-sandbox kernel ku-host kernel. Isebenzisa i-Microsoft hypervisor ukugcina lezi zindawo ezimbili zihlukene.
• Iyasebenza: ukuqalisa kuyashesha, ngemizuzwana embalwa, ngokuphathwa kwememori okuhlakaniphile kanye nokusekelwa kwe-GPU ebonakalayo, kusetshenziswa izinsiza ezimbalwa kune-VM yendabuko.

Ngobuchwepheshe, kuziphatha njengo umshini omncane we-Windows virtual ongasetshenziswa kabusha, isebenza kahle kakhulu ekuhloleni abafaki, ukuvakashela amawebhusayithi angabazisayo noma ukuvula okunamathiselwe kwe-imeyili ongathembi ukuthi kuzosebenza ohlelweni lwakho lwangempela.

Izimo ezisebenzayo zokusebenzisa i-Windows Sandbox

Kunezimo eziningana ezijwayelekile lapho i-Windows Sandbox ikhanya khona njengesisombululo se-sandboxing esilula ngesandla:

• Zama isofthiwe engaziwaUma ulanda uhlelo lokusebenza noma i-executable kusuka ku-inthanethi futhi ungaqiniseki ngemvelaphi yalo, ungalifaka kuqala ngaphakathi kwe-Windows Sandbox bese ubona ukuthi liziphatha kanjani ngaphandle kwengozi kukhompyutha yakho.
• Ukuphequlula iwebhu okuphephile: ngoba Ukuvakashela amawebhusayithi angaba yingozi, i-malware noma amasayithi obugebengu bokweba imininingwane ebucayiUngavula isiphequluli sakho ngaphakathi kwebhokisi lesanti. Uma kukhona okungahambi kahle, ukuvala nje ifasitela kuzosusa noma yimuphi umkhondo.
• Ukuvula okunamathiselwe okungathembekile namafayelaUma uthola okunamathiselwe okusolisayo noma ifayela le-ZIP elingakukhuthazi ukuzethemba, ulikopishela ebhokisini lesanti, ulivule lapho, bese uma selibuyekeziwe, unquma ukuthi kufanelekile yini ukukhipha noma yini ohlelweni lwakho lwangempela.
• Imiboniso kanye nokuhlolwa kwamathuluzi athileIlungele ukudala ama-demo esofthiwe, ukuhlola izinguqulo zokubuka kuqala, izandiso, noma izengezo ngaphandle kokuphazamisa ukufakwa kwakho okuyinhloko.
• Gcina izindawo eziningi zentuthuko ezihlukeneUngakha izikhala ezihlukene, ezihlukanisiwe ze-stack ngayinye yolimi noma inguqulo, isibonelo ibhokisi lesihlabathi lenguqulo ngayinye yePython kanye nokuncika kwayoukuze izivivinyo zingaphazamisi indawo yakho ezinzile.

Izidingo namalayisense okusebenzisa i-Windows Sandbox

Akuwona wonke umuntu ongasebenzisa i-Windows Sandbox, kodwa isivele itholakala ezindaweni eziningi zobungcweti. Ukuze uyivule kukhompyutha yakho, udinga:

• I-Windows Edition EhambisanayoI-Windows 10/11 Pro, i-Enterprise, i-Pro Education/SE noma i-Education. Uhlelo lwasekhaya alusekelwa.
• Usekelo lwe-VirtualizationKubalulekile ukuba ne imisebenzi ye-virtualization ku-BIOS/UEFI (Intel VT-x, AMD-V noma efanayo).
• Izinsiza ezincane: okungenani i-4 GB ye-RAM (yize kunconywa i-8 GB), i-1 GB yesikhala sediski samahhala — okungcono i-SSD— kanye nama-cores ama-CPU amabili okungenani (kungcono ama-4 ane-hyperthreading).
• Isistimu yokusebenza ebuyekeziweKuqala ngokwakhiwa okuthile (isibonelo, i-Windows 10 yakha i-18305 neyakamuva, kanye nokwakhiwa kwesimanje kwe-Windows 11). Ku-ARM64, ukuhambisana kufike ngokwakhiwa kwakamuva.

Ngokuphathelene namalayisense, Izinhlelo ze-Pro, Enterprise, kanye ne-Education zifaka ilungelo lokusebenzisa i-Windows Sandbox Asikho isidingo sokukhokhela amalayisense engeziwe esofthiwe ye-virtualization. Vele uyivule bese usukulungele ukuhamba.

Indlela yokusebenzisa i-Windows Sandbox ngaphandle kwamathuluzi engeziwe

Ukuze uyiqalise, awudingi lutho olungaphandle kohlelo uqobo:

1. Vula imenyu ethi Qala bese ubheka inketho "Vula noma uvale izici zeWindows".
2. Ohlwini lwezici, phawula I-Sandbox yamaWindows futhi uqinisekise.
3. Qala kabusha ikhompyutha yakho uma ucelwa.
4. Ngemva kokuqala kabusha, sesha i-"Windows Sandbox" kumenyu yokuqala bese uyiqalisa.

Uma ukhetha indlela yobuchwepheshe kakhulu, ungayivula futhi nge-PowerShell usebenzisa umyalo Nika amandla-WindowsOptionalFeature -Igama Lesici “Iziqukathi-I-DisposableClientVM” -Konke-Ku-inthanethiuma nje unamalungelo okuphatha. Uma usuvuliwe, i-sandbox izohlala itholakala noma nini lapho udinga lowo "mshini wesibili" ophephile.

Amafayela okumisa nokwenza ngokwezifiso

Ukusekelwa kwe-Windows Sandbox amafayela okucushwa alula akuvumela ukuthi wenze ngezifiso amapharamitha athile emveloIsibonelo, ukufaka amafolda e-host kumodi yokufunda noma yokufunda nokubhala, ukukhubaza inethiwekhi, ukusebenzisa izikripthi ekuqaleni, njll. Lawa mafayela ayatholakala kusukela ezakhiweni ezithile ze-Windows 10 kanye ne-11.

Empeleni, leli khono likusiza ukuthi udale "izindlela zokupheka" zebhokisi lesanti: ukucushwa okukhutshaziwe kwenethiwekhi ukuvula i-malwareEnye enefolda yephrojekthi efakwe kwimodi yokufunda kuphela yokubuyekeza amafayela, noma ukucushwa okuqondiswe ekuhlolweni kwesofthiwe ngamathuluzi athile afakwe kusengaphambili esithombeni esiyisisekelo.

Indlela yokufundisa ama-AI agents ukusebenzisa i-sandbox ngendlela efanele

Ibhokisi lesihlabathi lisebenza ngempela kuphela uma I-ejenti yekhodi ngokwayo iyaqonda indawo esebenza kuyo. futhi uyazi ukuthi ingasebenza nini ngokukhululeka nokuthi nini lapho idinga ukucela imvume eyengeziwe noma usizo lwabantu.

Ukuze kufezwe lokhu, amapulatifomu amaningi kuye kwadingeka abuyekeze ngokuphelele ingqalasizinda echaza amathuluzi kumodeli. Isibonelo, ukubuyekeza izincazelo zamathuluzi egobolondo ukuze kuchazwe ngokucacile:

• Yimiphi imingcele ebekwa yi-sandbox? (ukufinyelela ohlelweni lwefayela, i-git, inethiwekhi).
• I-ejenti ingakwenza kanjani lokho cela ukuthuthukiswa kwezimvume lapho okuthile kwehluleka ngenxa yokuntuleka kwamalungelo.
• Yiziphi izinhlobo zemiyalo okungenzeka kakhulu ukuthi zivinjwe?

Lezi zinguquko azihlali ziphuma kahle okokuqala: ngokuvamile zidinga Ukuhlolwa okubanzi ngesandla kokugeleza kokuthunyelwa kwangempelaUkuhlaziya lapho okulindelwe yimodeli kwehla khona futhi kulungiswa izixwayiso nemiyalelo. Ngokulinganisa ukuziphatha ngebhokisi lesanti nangaphandle kwalo kumabhentshimakhi angaphakathi, kutholakala amaphethini okuhluleka, njengezithunywa ezisebenzisa Baphinda umyalo ofanayo ku-loop evinjwa yi-sandbox. esikhundleni sokuqonda ukuthi badinga ukucela ezinye izimvume noma ukuguqula isu labo.

Intuthuko engokoqobo izobonakala emiphumeleni yethuluzi isizathu esithile sebhlokhi elibekwe yi-sandbox futhi iphakamise ngokusobala kumenzeli ukuthi acele izimvume eziphakeme uma kufaneleka. Leli cebiso elincane linciphisa kakhulu ukuzama kabusha okungaboni futhi lithuthukisa ukululama emaphutheni ahlobene nokuhlukaniswa, kokubili ekuhlolweni okungaxhunyiwe ku-inthanethi nasekukhiqizweni.

Ukuqinisekisa ukuthi i-sandbox ayilimazi ulwazi lomsebenzisi, izinkampani eziningi zikhethe yisebenzise kancane kancaneUkuqoqa impendulo yangaphakathi neyangaphandle ngaphambi kokuyisebenzisa ngokuzenzakalelayo. Idatha ivame ukuba sobala: ingxenye enkulu yezicelo (isibonelo, cishe ingxenye yesithathu) igcina isebenza ngaphakathi kwebhokisi lesanti kumapulatifomu ahambisanayo, kanye nokuncipha okuphawulekayo kokubili kokulinda ukuvunyelwa kanye nesikhathi sokubuyekeza ngesandla.

Amamodeli okuhlukaniswa kanye nezifundo zokuphepha zangempela

Empeleni, ayikho "ibhokisi lesihlabathi eliphelele" elilodwa. Kunomehluko obalulekile phakathi isitsha se-kernel esabiwe, i-sandbox efana ne-gVisor, i-microVM, kanye ne-VM epheleleLokho kuhlukahluka kubalulekile uma sikhuluma ngokuvumela i-ejenti ukuthi isebenzise i-Docker, ifake amaphakheji angahleliwe, noma iqalise iziphequluli nezintambo eziyinkimbinkimbi.

Izigameko zokuphepha zomlando zigcizelela ukubaluleka kokukhetha ngokuhlakanipha: ubuthakathaka obufana I-CVE-2019-5736 noma i-CVE-2024-21626, okuvumela ukugxuma kusuka esitsheni kuya ku-host noma ukuguqula ama-binary esistimu, kukhombisa ukuthi uma umkhawulo wakho wokwethembana kuyisikhathi sokusebenza kwesitsha ku-kernel ye-host, i-bug enzima ingawisa yonke isithiyo.

Lokhu kuba bucayi kakhulu ngama-ejenti okubhala amakhodi ngoba avame ukwenza ikhodi yokuhlanganisa engathembekile, ukwakha izithombe, ukufaka izinto ezixhomeke kuzo ngaphandle kokuhlola futhi ngokuvamile baphatha okokufaka okuhlukahlukene kakhulu. Ngaphezu kwalokho, ingcindezi "yokubanika amandla engeziwe" inamandla: uma bengakwazi ukusebenzisa amathuluzi athile, bavame ukwehluleka ukuqeda imisebenzi yabo.

Yingakho imiklamo eminingi yesimanje ye-sandbox ye-agent ivame ukwenza kanjalo qinisa umngcele usebenzisa ama-microVM noma ama-VM alulaLokhu kuza ngezindleko zokwanda kancane kobunzima. Ukuthembela okuqondile ku-kernel yokusingatha kuyancishiswa, futhi kutholakala ungqimba olwengeziwe lokuhlukaniswa ngokumelene nokuphuma kwesitsha. Ezindaweni ezinabantu abaningi abaqashayo noma ekusetshenzisweni okukhulu kwekhodi engathembekile, i-gVisor noma i-Kata Container isendaweni ephakathi, ishintshana ngokuhambisana ukuze ihlukaniswe kakhulu.

Ukuvunyelwa kwabantu, ukuvunyelwa kwezepolitiki, kanye namabhokisi e-sandbox: indlela yokukuhlanganisa konke ndawonye

Iphethini eyodwa ephindaphindwayo yonke indawo yile Izicelo zemvume yaphakade azikhuli kahleKumodi yedemo, kulungile ukuthi umenzeli acele imvume ngaphambi kokuthinta ifayela. Ekukhiqizeni, ngezinhlelo zokusebenza ezizimele kanye nezenzo eziningi ezincane, imodeli ethi "chofoza u-OK kuyo yonke into" igcina isiyisivi.

Indlela evuthiwe ihlanganisa izendlalelo eziningana:

• Ibhokisi lesanti eliqinile ukuvikela umsingathi nokunciphisa indawo yokusebenza.
• Inqubomgomo yenethiwekhi ekhawulelwe ukulawula ukuthi yiziphi iziphetho i-ejenti engakhuluma nazo.
• Ukuphathwa kweziqinisekiso nge-proxyukuze imodeli izisebenzise ngaphandle kokuzibona.
• Ukulungiswa okuhunyushiwe ezingeni lephrojekthi (izimvume, ama-hook, amaseva angaphandle) ukuze amaqembu abe nomthombo owodwa weqiniso endaweni yokugcina izinto.
• Ama-subagent afundwayo kuphela ukuhlola nokuhlela, ukushiya izenzo zokubhala ezimweni ezilawulwa kakhulu.
• Ukuvunyelwa kwabantu kugcinelwe izenzo ezibucayi ngempela: ukushicilela amaphakheji, izinguquko zengqalasizinda, ukushintshanisa izimfihlo, noma ukusunduzela emagatsheni abalulekile.

Ngaphezu kwalokho, kufanelekile ukucabangela indawo yokulawula okunikeza umenzeli ngamafayela akho okucushwa, ama-plugin, namakhono. Iziqondiso ezivela kubahlinzeki abanjengo-OpenAI zixwayisa ngokusobala ukuthi ukudalula amakhathalogi avulekile amakhono noma ukuvumela noma ubani ukuthi achaze imiyalelo enamandla ngaphakathi kwendawo yokugcina kungaholela ekuvuthweni kwedatha noma ezenzweni ezibhubhisayo uma umhlaseli ekwazi ukufaka imiyalelo enonya kumafayela e-README, izinkinga, imibhalo, noma amafayela esampula.

Ekwakhiweni komsindo, ibhokisi lesanti alibhekwa njengeqhinga lomlingo elilungisa ukuphepha ngesikhathi esisodwa, kodwa njenge omunye umngcele ngaphakathi kwesakhiwo esihlanganisa izinqubomgomo, ukuqinisekiswa okuzimele, ukuphathwa ngokucophelela kwezimfihlo, kanye nokubuyekezwa kokucushwaNgakho-ke, ngisho noma sicabanga ukuthi ngelinye ilanga umenzeli ufunda imiyalelo enonya futhi ayilalele, uhlelo lwenzelwe ukunciphisa umthelela: akukho ukufinyelela okuqondile kumakhi, akukho nethiwekhi evulekile, futhi akukho khono lokushintsha ngasese izikripthi ozisebenzisa emshinini wakho wangempela.

Ekugcineni, ukusetha i-sandbox enhle yesandla ngaphandle kokuthembela kusofthiwe eyengeziwe kuhilela... Sebenzisa ngokugcwele lokho i-macOS ne-Linux esezivele zikunikeza kona. —Amaphrofayili e-Seatbelt, i-Landlock, kanye ne-seccomp, i-Windows Sandbox, kanye ne-WSL2—, kuhlanganiswe nemithetho yenethiwekhi ecacile, iziqinisekiso, kanye nokuphathwa komjikelezo wokuphila kwemvelo. Engeza kulokho ama-ejenti aqeqeshwe ukuqonda le mikhawulo, izinqubomgomo ezinengqondo, kanye nesiyalo esithile mayelana nalokho abavunyelwe ukufinyelela kukho endaweni yakho yokusebenza, futhi ungahlola ikhodi eyingozi, amathuluzi, namafayela ngokuthula okukhulu kwengqondo, wazi ukuthi uma kukhona okungahambi kahle, inkinga izohlala igcinwe ngaphakathi kwe-sandbox futhi ngeke isuse uhlelo lwakho noma idatha ebalulekile. Yabelana ngolwazi ukuze abasebenzisi abaningi bakwazi ukufunda ngalesi sihloko.