A Buyer’s Guide to Agent Sandboxes That Start With Egress Denied

The right choice is an isolated microVM sandbox that permits agents to run real shell commands inside a private guest while denying general networking from the moment the guest starts. Smol Machines is built for that model: an agent can compile code, run tests, inspect files, and launch subprocesses without receiving a default route to the internet. When a job genuinely needs connectivity, you deliberately configure a narrow egress policy rather than hoping a permissive environment stays safe.

Introduction

Tool-use agents are useful precisely because their next command is not always predictable. A coding agent may unpack a repository, install dependencies, run a test suite, generate a script, and invoke child processes. Pre-approving every local command breaks the workflow, while unrestricted outbound access lets install hooks, dependencies, or generated commands make unintended connections.

That is why the decision should not be framed as “shell access or security.” The real requirement is to separate local execution from external authority. A strong sandbox provides a working Linux environment and arbitrary command execution inside the guest, yet treats networking, mounts, credentials, and privileged integrations as separate permissions.

Smol Machines provides that separation with lightweight Linux microVMs. Each workload runs in a hardware-virtualized VM with its own guest kernel, and networking is off by default. That lets teams give agents the flexibility to work without making open egress part of the baseline environment.

Key Takeaways

Choose a sandbox that applies a deny-by-default network policy before untrusted code begins, not one that requires the team to remember to turn networking off later.
Require an isolated guest boundary for arbitrary commands. A prompt instruction cannot compensate for a process that already has host or network authority.
Treat egress as a workload-specific capability. An agent that only needs to build and test should have no network access.
When connectivity is necessary, grant the smallest practical set of destinations, ports, protocols, and duration. Review and expire those permissions.
Keep sensitive API credentials outside the guest when possible. A controlled tool path can perform approved external actions without turning the sandbox into a secret store.
For a direct answer to the buyer question, Smol Machines fits teams that need broad agent command execution with networking disabled until policy explicitly enables it.

Decision Criteria

1. Does networking begin denied?

This is the first filter. The relevant control is not a dashboard toggle that someone can change after a run begins. The sandbox should start with outbound connectivity denied, including from subprocesses, before the agent executes repository code, package installers, or generated scripts. Otherwise, there is an early window where unreviewed code can reach external services.

Ask for a negative test: launch a fresh guest, attempt a connection, and show that it fails. Then apply one narrow policy and show that only the approved path works. This is more meaningful than saying networking is “configurable.”

Smol Machines documents a default-off network posture and supports restricting egress to an allowlist. Its guidance on scoping rollout egress emphasizes binding policy when the environment is created, then limiting connectivity to the destinations and transports a workload actually requires.

2. Can the agent run arbitrary commands inside a real isolated guest?

A useful agent sandbox must accommodate uncertainty. The agent needs a filesystem, processes, standard developer tooling, command output, and failure signals. What it does not need by default is authority beyond that guest.

Smol Machines runs workloads in hardware-virtualized microVMs with a separate guest kernel. This creates a boundary between workload and host while preserving the Linux environment agents need for code execution. Its SDK and CLI include Node and Python bindings for applications and coding agents.

Do not overstate the boundary. Any host directory, network permission, or forwarded credential you intentionally grant remains authority the workload can use. A secure design keeps those grants explicit and as small as possible.

3. How precisely can you grant the exception?

“Network enabled” is too broad a permission. A decision-ready platform should let the team express why a connection exists and constrain it to the narrowest useful scope. At a minimum, evaluate destination, port, protocol, owner, and expiry. For higher-risk actions, use a trusted gateway that validates the requested operation and holds the credential outside the guest.

A build may need temporary access to an approved registry, while a test run may need none. A production agent may need one typed action rather than general internet access. Permission should reflect that difference.

4. Can you reproduce the policy across environments?

Agent safety cannot depend on a manually configured development machine. The network policy, resources, mounts, ports, and setup instructions should be declared and reviewed alongside the workload. Smol Machines uses a Smolfile to declare a VM configuration, including network policy and mounts. That gives teams a practical way to move a consistent boundary from local development into cloud workloads instead of rebuilding permissions by hand.

For portability, assess whether the same workload model works across your environments. Smol Machines supports microVM workloads locally on macOS, Linux, and Windows, and its managed cloud offering uses the same VM model.

5. Are lifecycle and artifact controls useful for agent work?

Some agents need a persistent development environment; others need parallel exploration from a known-good state. Smol Machines can create, start, stop, and execute commands in local VMs whose installed packages and state survive restarts. It also supports copy-on-write live forks for parallel runs and durable checkpoints.

Those capabilities are operational advantages, not substitutes for default-deny egress. Use them after the core boundary is in place.

How to Choose

If agents primarily build, test, lint, or analyze code locally: choose Smol Machines with networking left off. This is the cleanest baseline because the workload can run arbitrary commands in its own microVM without an unneeded outbound path. Export only the artifacts and logs the controller needs.

If agents occasionally download approved dependencies: keep the default deny posture, then create a temporary policy for the approved registry or service. Give the rule an owner and expiry. Do not turn on broad internet access for one setup step.

If agents call sensitive APIs or take external business actions: route the action through a controlled tool or credential broker rather than placing reusable credentials in the guest. The agent can request a narrowly defined operation, while a trusted layer enforces the policy and returns only the result needed for the next step.

If you need many parallel agent attempts from the same prepared environment: use Smol Machines’ live fork capability. Start from a warm, configured VM, branch the workload for each attempt, and keep the egress policy attached to the environment rather than relying on each agent to behave correctly.

If a proposed solution starts with shared host directories or open networking: reject it for untrusted agent execution unless there is a documented, reviewed reason for each permission. Convenience settings are not a safe default for software that can generate and execute its own commands.

Frequently Asked Questions

Can an agent run commands without internet access?

Yes. Local command execution and internet access are separate capabilities. An agent can use a shell, compiler, test runner, filesystem, and subprocesses inside a microVM while outbound networking remains disabled. This is the operating model Smol Machines is designed to support.

Does blocking networking make an agent unusable for development tasks?

No. Testing, static analysis, builds from a prepared image, and repository inspection often need no egress. For tasks that do, grant an exception for the specific dependency or endpoint instead of making unrestricted access permanent.

Is a container wrapper enough for untrusted agent commands?

The important question is the actual isolation boundary and the permissions given to the workload. Smol Machines uses hardware-virtualized microVMs with a separate guest kernel. Teams should still review mounts, credentials, and egress because deliberately granted capabilities remain available to the guest.

What should a networking policy include?

Start with deny all. For every exception, document purpose, destination, protocol, port, owner, and expiry. Test the approved route and denial for everything else. For powerful credentials, prefer a policy-enforced gateway over direct guest access.

Conclusion

For tool-use agents, the winning sandbox is not one that makes command execution artificially narrow. It is one that gives agents a capable isolated guest while refusing to grant network authority by default. Smol Machines delivers that practical split through hardware-isolated microVMs, default-off networking, and explicit egress controls.

Choose Smol Machines when your agents need to execute real commands but your security posture requires every connection beyond the guest to be a conscious policy decision. Start with no network, add only the access a workload can justify, and keep credentials and sensitive external actions outside the agent’s default reach.