SideKernel：面向 macOS 上 AI 编码代理的可用微虚拟机沙箱
SideKernel: A Usable microVM Sandbox for AI Coding Agents on macOS
浏览论文内容
中文总结 AI 辅助
针对 macOS 上 AI 编码代理的安全需求，提出基于微虚拟机、注重可用性的开源沙箱 SideKernel，并通过用户调查和对比测试验证其优势。
中文摘要 AI 辅助
AI 编码代理是不可信的系统组件，但它们需要在所运行的开发者机器上拥有自主性。这一矛盾构成了一个安全问题。沙箱提供了隔离环境，但对于本地 macOS 开发而言，现有的本地开源 AI 编码代理沙箱选项数量稀少且使用繁琐。我进行了一项形成性在线用户调查，结果表明，只有不到 40% 的 AI 编码代理用户在其沙箱中运行代理，并指出了阻碍 AI 编码代理沙箱采用的主要可用性障碍。这些发现被用于开发 SideKernel：一个面向 AI 编码代理的开源、本地、基于微虚拟机（microVM）的 macOS 沙箱，专为可用性而设计。为评估 SideKernel，我编制了一份市场上可用的沙箱列表，并根据五项纳入标准对其进行了筛选。随后，我在 SideKernel 与满足这些标准的沙箱之间进行了比较分析，涵盖了源自用户调查所揭示的可用性障碍的 23 项能力测试。我发现，只有少数沙箱与 SideKernel 类似，而在这些沙箱中，Docker 沙箱和 SideKernel 在与可用性相关的能力特征上得分最高。本文的另一个次要贡献是对现有本地、开源、基于微虚拟机（microVM）的 macOS AI 编码代理沙箱解决方案空间的调查。
英文摘要
AI coding agents are untrusted system components, yet they require autonomy on the developer machines they run on. This contradiction is a security problem. Sandboxes provide an isolated environment, but for local macOS development, the existing local, open-source options for AI coding agents are few in number and cumbersome to use. I conducted a formative online user survey which indicates that fewer than 40% of AI coding agent users run their agents in a sandbox and identifies the top usability barriers hindering AI coding agent sandbox adoption. These findings are used to develop SideKernel: an open-source, local, microVM-based macOS sandbox for AI coding agents designed for usability. To evaluate SideKernel, I compiled a list of sandboxes available on the market and filtered it against five inclusion criteria. Then I performed a comparative analysis between SideKernel and the sandboxes that satisfy these criteria, across 23 capability tests derived from the usability barriers revealed by the user survey. I discovered that only a few sandboxes are similar to SideKernel, and that among those, Docker Sandboxes and SideKernel score highest on capability features related to usability. A secondary contribution of this paper is a survey of the existing solution space for local, open-source, microVM-based macOS sandboxes for AI coding agents.
发表机构
- Georgia Institute of Technology（佐治亚理工学院）
机构由 AI 辅助整理，请以论文原文为准。
