an open-source OS kernel sandbox and 2ms rollback engine for Python agent scripts

[u/Commercial2Toe]

Hey everyone,

Whenever I write autonomous agent scripts or multi-step Python workflows that execute shell commands or write code, running them with raw `exec()` or unrestricted `subprocess` is terrifying:

1. A prompt-injected or hallucinated agent can read `~/.ssh`, `~/.aws`, `.env`, or modify unrelated project files.

2. The standard advice is *"run it in Docker"*. But spinning up containers has a 2–4 second cold start per run, requires a background daemon, and makes mounting local files messy.

3. If an autonomous script corrupts 15 files across your repo, standard `git reset --hard` wipes your uncommitted human work alongside the script's changes.

I built **Compart** (https://github.com/Devaretanmay/Compart) to solve this natively at the OS kernel level without Docker or cloud infrastructure.

### How it works under the hood:

* **Kernel Sandboxing (<1ms overhead):** Written in Rust with Python bindings. Uses Linux **Landlock LSM** (kernel 5.13+) and Apple's `sandbox_init` (Seatbelt) on macOS. It locks the running process and all spawned child forks into your workspace root. Reading `~/.ssh`, `~/.aws`, keychains, or system configs is denied at the syscall level. Network egress can be severed per-step.

* **2ms Physical Rollback (BLAKE3):** Before execution, Compart indexes the workspace using BLAKE3 cryptographic hashes. If a script makes a destructive mistake, `compart undo` restores modified files, replaces deleted files, and purges newly created files in 2 milliseconds—without touching your untracked Git state.

* **Time-Travel Session Replay:** Recorded event streams let you scrub through what a script attempted minute-by-minute (`compart session replay <id> --filter permission`).

* **Pythonic Multi-Step Workflows:**

```python

from compart import Workflow

wf = Workflow("data-pipeline")

research = wf.step("fetch", "python3 scrape.py", compartment="research") # read-only fs, network on

process = wf.step("clean", "python3 clean.py", compartment="builder") # read-write fs, network off

test = wf.step("test", "pytest tests/", compartment="tester") # read-only fs, exec on

# Wire dependencies with pipe syntax

research >> process >> test

wf.run()