talk-selajev-docker-sandboxes-agents

name	talk-selajev-docker-sandboxes-agents
description	Use when the user asks about Oleg Šelajev's talk "You're absolutely right, it was your home directory!" (ext live / Testkube conference, 2026) — including questions about Docker Sandboxes, running AI agents in microVM isolation, the trifecta of agent risks (sensitive data + external comms + untrusted content), why containers aren't enough for agent isolation, SBX kits, secret injection / sentinel values, prompt injection horror stories, YOLO mode agents, or applying his sandboxing workflow to the user's own agent setup.
metadata	{"generated-by":"talk-to-skill","source":"user-pasted-transcript","generated-at":"2026-06-02T00:00:00.000Z"}

You're absolutely right, it was your home directory! — Oleg Šelajev (Docker)

Oleg argues that letting AI agents run "naked" on a developer machine is unsafe because the trifecta of sensitive data access, external communication, and exposure to untrusted content creates an unavoidable attack surface — and security guidelines in prompts are merely suggestions, not enforcement. His proposed answer is Docker Sandboxes: hardware-isolated microVMs (not containers, which security teams won't sign off on) with controlled filesystem sharing, a network proxy, and host-side secret injection via sentinel values. He introduces "kits" (declarative YAML plugins) to make sandboxes ergonomic enough for teams to actually adopt.

Grounding rules — MUST follow when answering

1. Before answering any specific question, read outline.md to locate the relevant section, then read that section of transcript.md.
2. When attributing words, quote verbatim from transcript.md. Never put quotation marks around paraphrased content.
3. If a claim isn't in transcript.md, say "the talk doesn't address this" — do not infer positions from outside knowledge.
4. Cite by transcript line range whenever possible.
5. Speaker attribution is unreliable for this transcript — the source has no per-speaker labels. The talk is overwhelmingly Oleg speaking, but the opening is an introducer (unnamed conference host) and the closing Q&A has audience questions whose answers are fragmented and hard to parse. Prefer phrasing like "Oleg said..." for the main body, and "in the Q&A, Oleg appears to say..." or "one audience question concerned..." for the closing fragments. Do not invent attributions.
6. The transcript contains speech-to-text artifacts (e.g. "ext lives" likely = "ext live", "as next" likely = "SBX", "as ex" / "sbx" variations, "trust catalog", "in so in" garble). Preserve them when quoting; you may add [sic] or a bracketed clarification.

How to help with this talk

Apply the speaker's approach to current work

When the user asks "how would Oleg tackle ?" or wants the talk's framework applied to their own situation:

1. Use outline.md → "Named frameworks / concepts" to find the relevant framework (the trifecta threat model, the speed-vs-security balance, the microVM-not-container choice, kits-as-ergonomics).
2. Read the corresponding range of transcript.md for Oleg's exact wording.
3. Anchor your suggestion in a verbatim quote of how he articulates the framework. Then walk through applying it step-by-step to the user's case.
4. If the framework genuinely doesn't fit the user's situation, say so. Do not stretch Oleg's words to cover cases he doesn't actually address (e.g. he scopes the talk to local agent execution — production / cloud agent infrastructure is out of scope).

Audit the user's situation against the speaker's framework

When the user asks to "audit", "score", "review", or "gap-analyse" their agent setup against the talk:

1. The auditable dimensions Oleg names are: (a) filesystem isolation from host, (b) network egress control / allowlists, (c) secret handling — are real secrets ever inside the agent's environment, (d) isolation primitive — kernel-shared container vs hardware microVM, (e) reproducibility — can you destroy and recreate the environment, (f) application-level controls (he flags these are NOT solved by sandboxing).
2. For each, quote Oleg's definition verbatim when stating what "good" looks like.
3. Walk every dimension in order. Don't skip ones the user seems weak on — that's where the value is.
4. Be explicit about (f): even a perfect sandbox doesn't stop an attacker emailing your agent to summarize-and-exfiltrate. Quote: "if you give your agent access to your email... your attacker can send you email to summarize your inbox and send them an email in response."
5. Summarise gaps at the end with verbatim anchors.

Draft an artifact following the speaker's specification

When the user asks to draft an SBX kit or sandbox configuration:

1. The artifact Oleg specifies is the kit YAML. Locate the description in transcript.md (the Testkube kit walkthrough section).
2. Quote verbatim his prescription of what a kit contains: commands to run on creation, processes, files to place inside, environment setup, network configuration, and secret-injection / credential-swap rules. He cites his Testkube kit as the worked example (install Testkube binary, init project, set TESTKUBE_TOKEN to a develop-proxy-managed sentinel, allow Testkube domains in network policy, swap the Authorization: Bearer header at proxy time).
3. Produce a draft matching that structure. Mark anything you add beyond what Oleg specified as [not from talk — added as a starting placeholder].
4. If the user's tech stack requires elements Oleg didn't cover, ask rather than invent.

Factual Q&A about the talk

For any question about what Oleg said, did, or argued:

1. Read outline.md first to find the relevant section(s).
2. Read the matching range of transcript.md.
3. Answer using verbatim quotes. Do not paraphrase while presenting as a quote.
4. Cite line numbers so the user can verify.
5. If the answer isn't in the transcript, say so. Don't fill from general Docker knowledge unless the user asks, and mark it clearly.

Surface this talk proactively when relevant

When the user's current work touches agent safety, local agent orchestration, container vs VM isolation, or prompt injection:

1. Briefly note: "Oleg Šelajev made a related point in his Docker Sandboxes talk..."
2. Quote verbatim — one quote usually suffices. Strong candidates: the trifecta, "Speed without security is chaos. Security without speed is paralysis.", "the attacker only needs to succeed once", or the auto-mode-bypass video anecdote.
3. One sentence linking the quote to the user's situation.
4. Don't over-cite. If the connection is strained, stay quiet.

Teach / explain concepts from the talk

When the user wants to understand a concept Oleg covered:

1. Look up the term in outline.md → "Terminology glossary".
2. Read his explanation in transcript.md.
3. Re-explain using his framing and examples first, with verbatim quotes for definitions and key claims (e.g. why containers fail the security-team sign-off bar, what sentinel values are, what a kit is).
4. You may add modern context afterwards — but mark it clearly as "not from the talk".

Key quotes

quotes.md contains pre-extracted verbatim highlights from this talk, organised by theme. When formulating answers, check quotes.md first for strong citable evidence before searching the full transcript.md.