Tuor is a convenience wrapper around Gondolin to spawn microVM-based sandboxes that you can run your coding agent or other workloads in. It exposes many of Gondolin's features through a JSON-based config schema and makes them configurable on a global, project-by-project, or even folder-by-folder basis.
I am primarily building Tuor for myself – I wanted a VM-based solution and Gondolin looked the most promising (and also the most secure) to me but since it's mostly an SDK, it lacked the convenience I desired.
Most of the features below are provided verbatim by Gondolin. For users familiar with Gondolin, please see Differences to bare Gondolin.
-
Isolation: Strong, virtualization-based isolation between workload and host system using QEMU as hypervisor with heavily constrained guest ↔ host communication.
-
Ephemeral: VM disk images are copy-on-write and treated as disposable (will be deleted upon VM shutdown).
-
Full control over the guest file system & environment: Customize the rootfs by providing an OCI container image (WIP) and/or by mounting host directories (read-only or read/write) and volumes while hiding select files from the guest. Choose which environment variables should be available inside the guest.
-
Network control & secret injection: Restrict network egress to HTTP and specific hosts, and prevent the guest from seeing your auth tokens & secrets by injecting them into HTTP requests when the latter leave the sandbox.
-
File-based configuration: Configure your VM on a global, project-by-project, or even folder-by-folder basis. (Configs are merged, so you can define global defaults and fine-tune your config for each project.)
-
Convenience mode for NixOS users (experimental): Have Tuor mount Nix store & related dirs into the VM, set up PATH & other env vars, etc.
-
Platforms: Linux (since I daily-drive it), MacOS should™ mostly work but I am unable to test it (feedback is welcome!)
Using Mise:
mise use github:codethief/tuor
tuor run # Spawns VM and starts interactive shell
tuor --help # Explore the CLIUsing NPM's npx:
npx tuor-sandbox run # Spawns VM and starts interactive shell
npx tuor-sandbox --help # Explore the CLI- Installation
- CLI
- Configuration
- Differences to bare Gondolin
- Limitations & known issues
- FAQ
- Development
- How to report vulnerabilities.
- Since Tuor is a relatively thin wrapper around Gondolin, it follows the same architecture and threat model.
Tuor is in its early alpha stages and should be considered (very) experimental. Config schema and feature set might change at any time while I'm still trying to figure out what works best for my own workflow.
Other sandboxes I am aware of that provide comparable features and security guarantees:
Tuor wouldn't be possible without Gondolin and QEMU, which do all the heavy lifting. Huge thanks to their maintainers!