The sandbox environment addresses two core risks:
- code security: User-submitted code may contain malicious commands (e.g.
rm -rf), sandboxing prevents system sabotage through privilege isolation and resource limitation. - data isolation: Ensure that intelligences do not have access to sensitive files on the host, e.g. through Docker's
-vparameter restricts the accessible directories.
The framework provides three security options:
- basic program: By
deluser ${USER} sudoRemove administrator privileges and use the privilege control that comes with the system. - Intermediate Program: To run in a Docker container, the recommended commands are
docker run --rm -v /path/to/CogKernel-Pro:/app -w /app python:3.8 ...The - Advanced Programs: Restrict network access and storage volume mounts in conjunction with Kubernetes' Pod Security Policy.
Testing has shown that a sandboxed environment reduces the potential attack surface by 76% (based on CVE Vulnerability Database statistics).
This answer comes from the articleCognitive Kernel-Pro: a framework for building open source deep research intelligencesThe
May not be reproduced without permission:AI productivity tools " Why does Cognitive Kernel-Pro emphasize running in a sandbox environment? How is it configured?
English 
简体中文 
日本語 
Deutsch 
Português do Brasil