SysConf 2026 · Locked
Rexec: How to Safely Give AI Agents a Terminal
SysConf 2026 · Standard · 25 + 5
Rexec: How to Safely Give AI Agents a Terminal
Present P · Theme toggle in chrome · → ← · ?present=1 · speaker ?key=
Quick intro
I’m Alex Idowu - Co-founder & CTO at PipeOps, based in Lagos.
- I build platforms, sandboxes, and isolation for a living - Rexec, agents, multi-tenant Kubernetes.
- Decade-plus in cloud infra, IaC, and runtime security (gVisor, Firecracker, the messy middle).
- When I’m not in production logs: One Piece, open source for fun, and shipping small tools that scratch my own itch.
That’s enough about me - let’s talk terminals.
Security & limits
-
cgroup + caps - baseline Linux resource and privilege controls.
-
gVisor (runsc) - user-space kernel; my default for agent sandboxes. -
Firecracker - microVM when you need a guest kernel / harder boundary.
-
Default Docker (runc) - shares the host kernel; say so if that’s all you’re using. - TTL CPU / mem / PID + TTL - hard caps; thrash is a DoS on yourself. Limits = security.
Trade-off: density + no KVM → gVisor default; escalate to Firecracker when the threat model says so.
What the terminal can reach, and when it dies
-
Shell = network endpoint - peer traffic, metadata, HTTPS, DNS, demo ports.
- NET Egress modes - none · allowlist · full (you accepted the leak).
-
ICC off - stops sandbox-to-sandbox on a Docker bridge; not “no internet.”
- TTL Lifecycle - create → short-lived secrets → run → attach → delete.
-
Long-lived sandboxes - become bastions with worse accountability.
Stack
- UI Browser / CLI - where humans and agents attach (xterm.js, API clients).
- API Control API - auth, policy, create / exec / delete, WebSocket sessions.
-
PostgreSQL - users, agents, session metadata.
-
Container Manager → Docker - disposable cloud sandboxes (limits, network, runtime).
-
Agent Handler → BYOS - outbound WebSocket to your machine; no inbound SSH.