William Calderipe wcalderipe

Coding Agent Sandboxes — Comprehensive List

Compiled from awesome-lists (restyler/awesome-sandbox, webcoyote/awesome-AI-sandbox, bureado/awesome-agent-runtime-security) and a survey of vendor blogs / field guides published through 2026. Grouped by isolation primitive and then by deployment model.

1. OS-level primitives (no container, no VM)

These rely on kernel/userland features to constrain a normal host process. Lowest overhead, weakest boundary.

macOS Seatbelt / sandbox-exec — Apple's TrustedBSD-based MAC framework. Used directly by Codex CLI, Gemini CLI, and underneath Anthropic's srt.
Linux Landlock — Unprivileged filesystem/network LSM; default backend for Codex CLI on Linux.

Commit Message Guidelines

Short (72 chars or less) summary

More detailed explanatory text. Wrap it to 72 characters. The blank
line separating the summary from the body is critical (unless you omit
the body entirely).

Write your commit message in the imperative: "Fix bug" and not "Fixed
bug" or "Fixes bug." This convention matches up with commit messages

Shallow

Real unit test (isolation, no children render)

Simple shallow

Calls:

constructor
render

Gmail and GitHub

How to filter emails from GitHub in Gmail and flag them with labels.

The labels in this document are just examples.

Pull Request

Filter	Label

	<?xml version="1.0" encoding="UTF-8"?>
	<!-- OPML generated by NetNewsWire -->
	<opml version="1.1">
	<head>
	<title>Subscriptions-OnMyMac.opml</title>
	</head>
	<body>
	<outline text="AAAS: Keyword search for query" title="AAAS: Keyword search for query" description="" type="rss" version="RSS" htmlUrl="https://www.science.org/" xmlUrl="https://www.science.org/blogs/pipeline/feed"/>
	<outline text="News" title="News">
	<outline text="Ars Technica - All content" title="Ars Technica - All content" description="" type="rss" version="RSS" htmlUrl="https://arstechnica.com/" xmlUrl="https://feeds.arstechnica.com/arstechnica/index"/>

	#!/bin/bash

	# This script takes a remote repository and merges it into
	# the current one as a subdirectory

	set -e

	if [ -z "$1" ]
	then
	echo "Usage:"

	set-option -g default-command $SHELL
	set-option -g status-fg white
	set-option -g status-bg default
	set-option -g status-interval 5

	set-option -g message-fg white
	set-option -g message-bg default
	set-option -g message-attr bright

	set-option -g pane-border-fg black

	import java.io.FileDescriptor;
	import java.io.FileOutputStream;
	import java.io.IOException;
	import java.io.OutputStream;
	import java.io.PrintStream;

	public class HelloWorld{
	private static HelloWorld instance;
	public static void main(String[] args){
	instantiateHelloWorldMainClassAndRun();

	var Aws = require('aws-sdk');
	var sinon = require('sinon');

	// Only works for 'createBucket', 'update' and a few others since most API methods are generated dynamically
	// upon instantiation. Very counterintuitive, thanks Amazon!
	var createBucket = sinon.stub(Aws.S3.prototype, 'createBucket');
	createBucket.yields(null, 'Me create bucket');

	// For other methods, we can 'assign' the stubs to the proto, already defined function won't be overridden
	var listBuckets = Aws.S3.prototype.listBuckets = sinon.stub();

	# Hello, and welcome to makefile basics.
	#
	# You will learn why `make` is so great, and why, despite its "weird" syntax,
	# it is actually a highly expressive, efficient, and powerful way to build
	# programs.
	#
	# Once you're done here, go to
	# http://www.gnu.org/software/make/manual/make.html
	# to learn SOOOO much more.