{
  "format": "agent-article-v0",
  "article_id": "EA-048",
  "canonical_url": "/tools/ea-048-sandbox-code-interpreter",
  "page_type": "reference",
  "claim_ids": [],
  "evidence_ids": [
    "EVD-EA-048-URL-83E5AE1AD919",
    "EVD-EA-048-URL-D5EA77DBFD69",
    "EVD-EA-048-URL-3024891B2E67",
    "EVD-EA-048-URL-526480EEC27A",
    "EVD-EA-048-URL-DE427D5583A5",
    "EVD-EA-048-URL-F8C632742846",
    "EVD-EA-048-URL-2B9425B55BC4",
    "EVD-EA-048-URL-D6D7D96C0117",
    "EVD-EA-048-URL-84507E365477",
    "EVD-EA-048-URL-B85DC9207D05",
    "EA-048-R11-RESEARCH",
    "EA-048-R11-WEB-READBACK"
  ],
  "unknown_ids": [
    "EA-048-UNKNOWN-01",
    "EA-048-UNKNOWN-CURRENTNESS"
  ],
  "operational_object_ids": [],
  "provider": [],
  "models": [],
  "plans": [],
  "surfaces": [],
  "regions": [],
  "current_status": "UNKNOWN",
  "observation_status": "SPEC_ONLY",
  "freshness": "UNKNOWN",
  "last_verified": null,
  "supersedes": [],
  "superseded_by": [],
  "provenance": [
    "COMM-041-EA0048",
    "SRC-EA-048-URL-83E5AE1AD919",
    "SRC-EA-048-URL-D5EA77DBFD69",
    "SRC-EA-048-URL-3024891B2E67",
    "SRC-EA-048-URL-526480EEC27A",
    "SRC-EA-048-URL-DE427D5583A5",
    "SRC-EA-048-URL-F8C632742846",
    "SRC-EA-048-URL-2B9425B55BC4",
    "SRC-EA-048-URL-D6D7D96C0117",
    "SRC-EA-048-URL-84507E365477",
    "SRC-EA-048-URL-B85DC9207D05",
    "WEBBODY-EA0048-R8-8518DFFC"
  ],
  "article_sources": [
    {
      "id": "EVD-EA-048-URL-83E5AE1AD919",
      "evidence_class": "RESEARCH",
      "title": "1. [VERIFIED_SPEC | support/context/limit] NIST SP 800-190, Application Container Security Guide — Murugiah Souppaya, John Morello, Karen Scarfone / NIST. Canonical:",
      "href": "https://doi.org/10.6028/NIST.SP.800-190",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-048-URL-83E5AE1AD919"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "1. [VERIFIED_SPEC | support/context/limit] NIST SP 800-190, Application Container Security Guide — Murugiah Souppaya, John Morello, Karen Scarfone / NIST. Canonical: https://doi.org/10.6028/NIST.SP.800-190"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-048-URL-D5EA77DBFD69",
      "evidence_class": "RESEARCH",
      "title": "2. [OSS_PRACTICE | support/limit] Introduction to gVisor security — gVisor.",
      "href": "https://gvisor.dev/docs/architecture_guide/intro/",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-048-URL-D5EA77DBFD69"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "2. [OSS_PRACTICE | support/limit] Introduction to gVisor security — gVisor. https://gvisor.dev/docs/architecture_guide/intro/"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-048-URL-3024891B2E67",
      "evidence_class": "RESEARCH",
      "title": "2. [OSS_PRACTICE | support/limit] Introduction to gVisor security — gVisor.",
      "href": "https://gvisor.dev/docs/",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-048-URL-3024891B2E67"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "2. [OSS_PRACTICE | support/limit] Introduction to gVisor security — gVisor. https://gvisor.dev/docs/"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-048-URL-526480EEC27A",
      "evidence_class": "RESEARCH",
      "title": "4. [OSS_PRACTICE | support/context] Firecracker Design — firecracker-microvm / AWS-maintained OSS.",
      "href": "https://github.com/firecracker-microvm/firecracker/blob/main/docs/design.md",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-048-URL-526480EEC27A"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "4. [OSS_PRACTICE | support/context] Firecracker Design — firecracker-microvm / AWS-maintained OSS. https://github.com/firecracker-microvm/firecracker/blob/main/docs/design.md"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-048-URL-DE427D5583A5",
      "evidence_class": "RESEARCH",
      "title": "5. [OSS_PRACTICE | support/limit] Firecracker Production Host Setup Recommendations — firecracker-microvm.",
      "href": "https://github.com/firecracker-microvm/firecracker/blob/main/docs/prod-host-setup.md",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-048-URL-DE427D5583A5"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "5. [OSS_PRACTICE | support/limit] Firecracker Production Host Setup Recommendations — firecracker-microvm. https://github.com/firecracker-microvm/firecracker/blob/main/docs/prod-host-setup.md"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-048-URL-F8C632742846",
      "evidence_class": "RESEARCH",
      "title": "6. [OSS_PRACTICE / PRODUCT_VOLATILE | support/counter] Firecracker Release Policy / Releases — firecracker-microvm.",
      "href": "https://github.com/firecracker-microvm/firecracker/blob/main/docs/RELEASE_POLICY.md",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-048-URL-F8C632742846"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "6. [OSS_PRACTICE / PRODUCT_VOLATILE | support/counter] Firecracker Release Policy / Releases — firecracker-microvm. https://github.com/firecracker-microvm/firecracker/blob/main/docs/RELEASE_POLICY.md"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-048-URL-2B9425B55BC4",
      "evidence_class": "RESEARCH",
      "title": "6. [OSS_PRACTICE / PRODUCT_VOLATILE | support/counter] Firecracker Release Policy / Releases — firecracker-microvm. https://github.com/firecracker-microvm/firecracker/blob/main/doc",
      "href": "https://github.com/firecracker-microvm/firecracker/releases",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-048-URL-2B9425B55BC4"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "6. [OSS_PRACTICE / PRODUCT_VOLATILE | support/counter] Firecracker Release Policy / Releases — firecracker-microvm. https://github.com/firecracker-microvm/firecracker/blob/main/docs/RELEASE_POLICY.md ; https://github.com/firecracker-microvm/firecracker/releases"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-048-URL-D6D7D96C0117",
      "evidence_class": "RESEARCH",
      "title": "7. [OSS_PRACTICE | support/context] NsJail README / nsjail-3.6 release — google/nsjail.",
      "href": "https://github.com/google/nsjail",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-048-URL-D6D7D96C0117"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "7. [OSS_PRACTICE | support/context] NsJail README / nsjail-3.6 release — google/nsjail. https://github.com/google/nsjail"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-048-URL-84507E365477",
      "evidence_class": "RESEARCH",
      "title": "7. [OSS_PRACTICE | support/context] NsJail README / nsjail-3.6 release — google/nsjail. https://github.com/google/nsjail ;",
      "href": "https://github.com/google/nsjail/releases",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-048-URL-84507E365477"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "7. [OSS_PRACTICE | support/context] NsJail README / nsjail-3.6 release — google/nsjail. https://github.com/google/nsjail ; https://github.com/google/nsjail/releases"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-048-URL-B85DC9207D05",
      "evidence_class": "RESEARCH",
      "title": "8. [VERIFIED_SPEC / PRODUCT_VOLATILE | context/limit] Data residency and inference residency for ChatGPT — OpenAI.",
      "href": "https://help.openai.com/en/articles/9903489-data-residency-for-chatgpt",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-048-URL-B85DC9207D05"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "8. [VERIFIED_SPEC / PRODUCT_VOLATILE | context/limit] Data residency and inference residency for ChatGPT — OpenAI. https://help.openai.com/en/articles/9903489-data-residency-for-chatgpt"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EA-048-R11-RESEARCH",
      "evidence_class": "RESEARCH",
      "title": "EA-048 監査済みresearch / canonical revision binding",
      "supports": [
        "1. “sandbox”は単一技術ではなく、process identity、kernel attack surface、filesystem、network、resource、secret、artifact、lifecycle、loggingを束ねるexecution boundaryとして扱うべき。\n2. namespace/seccomp/cgroup/rlimit型は軽量で有効だがshared-kernelでありVM相当とは記述できない。\n3. gVisorはuserspace application kernelでhost-kernel直接surfaceを縮小する中間層だが、upstream runtime compromise、CPU side-channel、sandboxへ許可したresourceはfailure envelopeに残る。\n4. Firecracker型microVMはguest-kernel境界へ移し、jailer/seccomp/cgroup/privilege-dropと併用できるが、CVE・設定不備・patch遅延は残る。\n5. provider横断Coreは銘柄ではなく、per-execution identity、no ambient host secret、network default-denyまたは明示allowlist、minimal read-only base FS + bounded writable scratch、CPU/memory/PID/wall-clock/output/disk quota、syscall/device/capability restriction、ephemeral teardown、execution provenance、patched runtimeで定義する方が安定する。\n6. runtime package installやInternet accessは利便機能ではなくsecurity gate。許可する場合はsupply-chain・data exfiltration・callback channelを考慮し、offline curated imageまたはallowlisted proxyを選択肢に置く。\n7. uploaded files/generated artifactsの永続化はexecution isolationとは別claim。runtimeが短命でもartifact retention/data residencyが同じとは限らない。"
      ],
      "limit": "canonical監査・revision bindingの存在を示す。外部ソースcurrentnessが本文またはcontrol-planeで確定していない場合は、currentnessをUNKNOWNのまま保持する。",
      "origin_class": "AUDITED_CANONICAL_RESEARCH_PACKET",
      "source_or_experiment_ids": [
        "COMM-041-EA0048"
      ],
      "supporting_locators": [
        "COMM-041-EA0048",
        "EA-048-R5-LEGACY-MIGRATION-20261008-R1",
        "content/staging/EA-048.md"
      ],
      "scope": "監査済みEA本文・canonical revision・既存Source Graph relationの範囲。欠損currentnessは推測で閉じない。",
      "provenance_status": "AUDIT_PASS_CANONICAL_BINDING"
    },
    {
      "id": "EA-048-R11-WEB-READBACK",
      "evidence_class": "IMPL",
      "title": "EA-048 Web body identity / canonical readback",
      "supports": [
        "canonical staging bodyのSHA-256一致とR9 canonical ledger readbackをProduction projectionの入力として検証する。"
      ],
      "limit": "body identity/readbackは本文claim自体の真偽や外部ソースの最新性を追加保証しない。",
      "checked_at": null,
      "origin_class": "IMPLEMENTATION_READBACK",
      "source_or_experiment_ids": [
        "WEBBODY-EA0048-R8-8518DFFC"
      ],
      "supporting_locators": [
        "WEBBODY-EA0048-R8-8518DFFC",
        "content/staging/EA-048.md",
        "EA-048-R5-LEGACY-MIGRATION-20261008-R1"
      ],
      "scope": "R9/R10 canonical readback後のProduction生成時body identity。",
      "provenance_status": "CANONICAL_READBACK_BODY_HASH_MATCH"
    }
  ],
  "research_sections": [
    {
      "heading": "WHY_THIS_MATTERS_TO_UPDATE",
      "text": "Enterprise AIがコード実行・ファイル変換・shell・データ処理へ進むと、モデル出力自体がuntrusted workloadになる。プロンプト防御だけではhost compromise、秘密情報流出、横展開、resource exhaustion、外部送信を止められないため、Code Interpreterを独立したsecurity boundaryとして扱う必要がある。"
    },
    {
      "heading": "SCOPE_ROUTING",
      "text": "Enterprise AI Core: untrusted-code execution boundary / default-deny / least privilege / ephemeral lifecycle\nImplementation: Linux namespaces・seccomp・cgroups・rlimits / gVisor / microVM・Firecracker\nProvider mapping: managed Code Interpreter各製品のruntime・egress・retention・availability\nOrganization overlay: egress allowlist、artifact retention、logging、data residency、approved runtimes/packages\nGovernance/security/audit: execution provenance、policy、secret handling、incident boundary\nNon-LLM component: container runtime / application kernel / VMM / filesystem / network controls"
    },
    {
      "heading": "CLAIM_OR_RESEARCH_QUESTION",
      "text": "Q1. LLM生成コード実行で最低Coreとすべき隔離境界・防御層は何か。\nQ2. shared-kernel jail、gVisor型userspace application kernel、Firecracker型microVMは何を強化し何を保証しないか。\nQ3. managed Code Interpreterの「sandboxed」という公開表現だけでtenant固有のegress・retention・runtime安全性まで確定できるか。"
    },
    {
      "heading": "EVIDENCE TABLE",
      "text": "1. [VERIFIED_SPEC | support/context/limit] NIST SP 800-190, Application Container Security Guide — Murugiah Souppaya, John Morello, Karen Scarfone / NIST. Canonical: https://doi.org/10.6028/NIST.SP.800-190 . Final 2017-09-25; NIST page updated 2021-05-04; accessed 2026-09-13. Locator: publication abstract / container security concerns and recommendations. Containerizationはsecurity controlsを必要とする隔離機構であり、それ自体が任意コード安全性の証明ではない。\n2. [OSS_PRACTICE | support/limit] Introduction to gVisor security — gVisor. https://gvisor.dev/docs/architecture_guide/intro/ . rolling docs; accessed 2026-09-13. Locator: “How do Linux kernel security primitives work?”, “How does gVisor provide isolation?”, “What does gVisor not protect against?”. namespaces/seccompはhost Linux kernel上で執行される。gVisor Sentryはuserspace application kernelとしてhost syscall surfaceを縮小する一方、pre-sandbox stack compromise、Spectre型side-channel、sandboxへ意図的に公開したresourceの侵害を防ぐものではない。\n3. [OSS_PRACTICE | support/context] What is gVisor? — gVisor. https://gvisor.dev/docs/ . rolling docs; accessed 2026-09-13. Locator: What does gVisor do? / How is this different? / What is runsc?. Linux-like system interfaceをper-sandbox application kernelへ移し、OCI runtime `runsc` を提供する。\n4. [OSS_PRACTICE | support/context] Firecracker Design — firecracker-microvm / AWS-maintained OSS. https://github.com/firecracker-microvm/firecracker/blob/main/docs/design.md . main; accessed 2026-09-13. Locator: Seccomp / Jailer process / Cgroups and Quotas / Monitoring. per-thread seccomp、jailerによるcgroup/chroot設定とprivilege drop、cgroup quota、operator側のlog/metric収集を組み合わせる。\n5. [OSS_PRACTICE | support/limit] Firecracker Production Host Setup Recommendations — firecracker-microvm. https://github.com/firecracker-microvm/firecracker/blob/main/docs/prod-host-setup.md . main; accessed 2026-09-13. Locator: Jailer Configuration. production isolationはjailerまたは同等制約の正しい設定とtrusted input保護に依存する。\n6. [OSS_PRACTICE / PRODUCT_VOLATILE | support/counter] Firecracker Release Policy / Releases — firecracker-microvm. https://github.com/firecracker-microvm/firecracker/blob/main/docs/RELEASE_POLICY.md ; https://github.com/firecracker-microvm/firecracker/releases . accessed 2026-09-13. v1.16.1 latest observed, released 2026-07-02, release commit `2038188`; v1.16 supported. v1.16.0はCVE-2026-5747を修正し、v1.16.1でもjailer/network/vsock修正あり。microVM境界もvulnerability-freeではなくpatch lifecycleが必要。\n7. [OSS_PRACTICE | support/context] NsJail README / nsjail-3.6 release — google/nsjail. https://github.com/google/nsjail ; https://github.com/google/nsjail/releases . nsjail-3.6 released 2026-03-18; commit `f784755`; accessed 2026-09-13. Locator: README Features / 3.6 release notes. UTS/MOUNT/PID/IPC/NET/USER/CGROUPS/TIME namespaces、chroot/pivot_root/read-only mounts/tmpfs、CPU/memory/fd/process limits、seccomp-BPF、network isolationを合成でき、3.6ではread-only mount enforcementとseccomp policy fixesを含む。\n8. [VERIFIED_SPEC / PRODUCT_VOLATILE | context/limit] Data residency and inference residency for ChatGPT — OpenAI. https://help.openai.com/en/articles/9903489-data-residency-for-chatgpt . accessed 2026-09-13. Current ChatGPT Enterprise/Edu documentation. Locator: customer content stored in selected region / unsupported or out-of-region processing notes. Code Interpreter & Data Analysis artifactsはeligible data residencyの対象に明示される一方、一部CPU processingやexternal integrationsは選択地域外となり得る。これはdata governanceの証拠でありsandbox isolation strengthの証明ではない。"
    },
    {
      "heading": "FINDINGS",
      "text": "1. “sandbox”は単一技術ではなく、process identity、kernel attack surface、filesystem、network、resource、secret、artifact、lifecycle、loggingを束ねるexecution boundaryとして扱うべき。\n2. namespace/seccomp/cgroup/rlimit型は軽量で有効だがshared-kernelでありVM相当とは記述できない。\n3. gVisorはuserspace application kernelでhost-kernel直接surfaceを縮小する中間層だが、upstream runtime compromise、CPU side-channel、sandboxへ許可したresourceはfailure envelopeに残る。\n4. Firecracker型microVMはguest-kernel境界へ移し、jailer/seccomp/cgroup/privilege-dropと併用できるが、CVE・設定不備・patch遅延は残る。\n5. provider横断Coreは銘柄ではなく、per-execution identity、no ambient host secret、network default-denyまたは明示allowlist、minimal read-only base FS + bounded writable scratch、CPU/memory/PID/wall-clock/output/disk quota、syscall/device/capability restriction、ephemeral teardown、execution provenance、patched runtimeで定義する方が安定する。\n6. runtime package installやInternet accessは利便機能ではなくsecurity gate。許可する場合はsupply-chain・data exfiltration・callback channelを考慮し、offline curated imageまたはallowlisted proxyを選択肢に置く。\n7. uploaded files/generated artifactsの永続化はexecution isolationとは別claim。runtimeが短命でもartifact retention/data residencyが同じとは限らない。"
    },
    {
      "heading": "LIMITS / COUNTEREVIDENCE / FAILURE ENVELOPE",
      "text": "- NIST SP 800-190は2017年container guidanceで、2026年managed Code Interpreter固有挙動を証明しない。\n- namespace/seccompはkernel vulnerability、misconfiguration、過剰syscall allowance、privileged launch、unsafe device mountを消去しない。\n- gVisor自身がpre-sandbox compromise、Spectre型side-channel、意図的に公開されたresourceを範囲外としている。\n- Firecracker v1.16.0のCVE-2026-5747修正はmicroVMも絶対境界ではない反証。version/patch freshnessを運用要件化する。\n- nsjailをprivileged container内で動かす構成等では、新たなhost管理面を生み得る。\n- public provider docsのみではtenant固有のnetwork egress、filesystem lifetime、kernel/runtime、artifact purge semantics、secret visibilityを確定できない場合がある。UNKNOWNを残す。"
    },
    {
      "heading": "AVAILABILITY_GATES",
      "text": "OSS mechanismはhost kernel/KVM/architecture/permissionsに依存。Managed Code Interpreterはplan、workspace policy、region/data residency、runtime/package image、network policyをPRODUCT_VOLATILEとしてprovider mapping時に再確認。Organization overlayではoutbound network、package repository、file classification、retention、execution logging、approved languages/toolsを別gateにする。"
    },
    {
      "heading": "IMPLEMENTATION_STATE",
      "text": "A. Lightweight Linux jail: namespaces + seccomp-BPF + cgroups/rlimits + capability drop + read-only/minimal FS + network namespace.\nB. Userspace-kernel sandbox: gVisor/runsc等でhost-kernel surfaceを縮小。\nC. microVM sandbox: Firecracker等でguest-kernel境界を設け、jailer/seccomp/cgroups/privilege droppingを併用。\nD. Enterprise wrapper: one-shot execution ID、immutable base image、no ambient cloud credentials、bounded scratch、policy-controlled egress、timeout/quota/output cap、telemetry、teardown、artifact handoff。\nEvidence上、全用途に唯一必須のengineは確立しない。risk/cost/compatibilityで選択する。"
    },
    {
      "heading": "BENCHMARK_OR_EVAL",
      "text": "性能benchmarkをsecurity guaranteeへ外挿しない。Future TEST_PROFILE（未実施）: host `/proc`・mount・sibling PID・metadata endpoint・Unix socket・device node・privileged syscallへのnegative access、DNS/raw IP/redirect/IPv6/localhost/link-local/cloud metadata/package registry/arbitrary HTTPSのegress、fork/memory/CPU/disk/stdout/file-count/wall-clock resource exhaustion、cross-run residue、env/service-account token/mounted credential/inherited FD、execution ID→code/runtime image→network decision→artifact→termination reasonのaudit correlation。Disposable non-production、synthetic secrets、明示的authorization下のみ。"
    },
    {
      "heading": "SECURITY / PRIVACY / AUDIT / COST / OPERABILITY",
      "text": "Security: generated codeはuntrusted by default。単一primitiveでなくdefense-in-depth。\nPrivacy: transient runtimeとuploaded/generated artifact retention/data residencyを分離。\nAudit: execution ID、requesting principal/agent、code hash、runtime/image version、policy decision、resource consumption、egress destination/block、artifact、exit/kill reasonを記録し、raw secretは既定で記録しない。\nCost: stronger isolationはstartup/memory/compatibility costを伴い得る。quota/timeoutsはsecurityとFinOps両方のcontrol。\nOperability: image/runtime patching、reproducible version pinning、cleanup monitoring、failed-teardown detectionを必要とする。"
    },
    {
      "heading": "SAFE_WORDING_FOR_FUTURE_BOOK",
      "text": "「AIによるコード実行は、モデル機能ではなくuntrusted workload executionとして管理する。container、gVisor型sandbox、microVMは隔離強度・互換性・運用コストが異なり、いずれも単独で完全な安全性を保証しない。Enterprise運用ではnetworkとsecretをdefault-denyにし、filesystem・syscall/device/capability・CPU/memory/PID/time/outputを境界化し、実行環境を短命化して各実行のprovenanceと終了理由を監査可能にする。managed Code Interpreterは、公開機能の存在と、自組織tenantでのegress・retention・runtime・residency・管理policyを分離して確認する。」"
    },
    {
      "heading": "UPDATE_WORK_HANDOFF",
      "text": "- Core本文候補: “Untrusted Code Execution Boundary”。\n- 比較表候補: shared-kernel jail / userspace application kernel / microVMをkernel boundary・overhead・compatibility・network/FS control・patch surfaceで比較。\n- provider mapping再確認: runtime language/version、preinstalled packages、package install可否、Internet/egress、filesystem persistence、artifact retention、CPU/memory/time/file-size limits、secret injection、region/data residency、admin disable/control、logging/export。\n- TEST_PROFILEはsecurity appendixへ移植可能。実測するまでOBSERVEDへ格上げしない。"
    },
    {
      "heading": "OPEN_UNKNOWN",
      "text": "(1) major managed providerが採用する具体的kernel/runtime/hypervisor境界は公開資料で一律確定しない。(2) tenant別egress、cross-run residue、artifact purge timing、runtime patch cadenceはprovider/plan/regionごとに再確認が必要。(3) isolation方式を単一定量指標で順位付けする一次証拠は本packetでは採用しない。"
    },
    {
      "heading": "STOP_CONDITION",
      "text": "Core isolation model、主要実装3層、current release/version evidence、failure envelope、safe wording、未実施TEST_PROFILEまで揃ったため、EA-048初回Evidence Packetをbounded completeとする。provider固有実測は将来のprovider mapping/authorized testへ送る\n\n---"
    },
    {
      "heading": "AUDITED_BOUNDARY",
      "text": "Sandbox layers are bounded implementation patterns. Feature existence or data-residency documentation does not establish managed-provider kernel/runtime/hypervisor boundary, tenant egress, cross-run residue, artifact purge timing, patch cadence, or isolation ranking. Preserve all OPEN_UNKNOWN."
    }
  ],
  "human_url": "/tools/ea-048-sandbox-code-interpreter",
  "markdown_url": "/agent/article.md?path=%2Ftools%2Fea-048-sandbox-code-interpreter",
  "json_url": "/agent/article.json?path=%2Ftools%2Fea-048-sandbox-code-interpreter"
}