Secure AI Agent Code Execution: Replacing Fragile Docker Wrappers with Roche

Stop Writing Docker Wrappers for Your AI Agent’s Code Execution

Roche is a sandbox orchestrator that replaces manual Docker subprocess calls with a unified API for AI agent code execution. It implements a Rust core to manage security boundaries like no-new-privileges and 512MB memory limits by default.

Why This Matters

Engineers building AI agents frequently fall into the trap of writing bespoke Python wrappers around Docker subprocess commands, leading to critical security regressions when flags like —network=none are omitted. Technical reality demands robust resource isolation, cleanup on crash, and provider flexibility—features that are often neglected in DIY implementations, resulting in fragile systems where LLM-generated code can perform unauthorized HTTP requests or trigger fork bombs.

Key Insights

• Secure defaults in Roche include a 300-second timeout and a 64 PID limit to prevent resource exhaustion from infinite loops or fork bombs.
• The roche-core system, written in Rust, provides a SandboxProvider trait to abstract differences between Docker, Firecracker microVMs, and WebAssembly.
• Manual Docker wrappers often fail at cleanup; Roche uses Python context managers to ensure sandbox destruction even when the agent code throws an exception.
• The system supports both synchronous and asynchronous execution patterns, making it compatible with modern agent frameworks like LangChain, CrewAI, and AutoGen.

Working Examples

Standard usage of Roche for secure code execution using a context manager.

from roche_sandbox import Roche
with Roche().create(image="python:3.12-slim") as sandbox:
    result = sandbox.exec(["python3", "-c", "print('hello')"])
    print(result.stdout)

Implementing Roche within an asynchronous workflow for AI agents.

from roche_sandbox import AsyncRoche
async def run_code(code: str) -> str:
    roche = AsyncRoche()
    async with (await roche.create()) as sandbox:
        result = await sandbox.exec(["python3", "-c", code])
        return result.stdout

Practical Applications

• Use case: OpenAI Agents utilizing function_tool to execute Python code in a secure environment with restricted CPU and memory. Pitfall: Forgetting to set no-new-privileges, allowing potential privilege escalation within the container.
• Use case: Infrastructure teams swapping Docker for Firecracker microVMs to achieve stronger isolation without modifying the agent’s core logic. Pitfall: Hardcoding Docker-specific subprocess strings that make the system non-portable.

References:

• https://dev.to/leland_fy/stop-writing-docker-wrappers-for-your-ai-agents-code-execution-1c5b