From 4e2ec26744ddf7d370b31cade58a32f9dda07e0f Mon Sep 17 00:00:00 2001
From: Ertug Karamatli <107676+ertug@users.noreply.github.com>
Date: Mon, 27 Jul 2026 23:29:20 +0000
Subject: [PATCH] Add kvm-jailbox to Sandboxing & Isolation

Persistent libvirt/KVM development VMs with nftables-enforced private-network
denial, clean-traffic anti-spoofing, and a reduced device model.
---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index 4d6f934..e45e2d7 100644
--- a/README.md
+++ b/README.md
@@ -51,6 +51,7 @@ Projects using **Linux** security primitives (and a few Mac exceptions) such as
 | [goose + boxlite discussion](https://github.com/block/goose/issues/6040) | KVM, libkrun | GitHub issue discussing integration of boxlite KVM-based sandboxing into Block's goose agent framework. |
 | [smolVM](https://github.com/smol-machines/smolvm) | KVM, libkrun, MicroVM | MicroVM sandbox using [libkrun](https://github.com/containers/libkrun) and KVM with <200ms boot, network off by default, and a `pack` command that builds portable single-binary VMs. |
 | [Freestyle](https://www.freestyle.sh/) | KVM, MicroVM, nested-virt | Managed agent-scale sandbox infrastructure: full Linux KVM VMs (not containers) with nested virtualization, real root access, sealed multi-user isolation inside each VM, git repos per agent with bidirectional GitHub sync, scales to 10k+ concurrent agents. |
+| [kvm-jailbox](https://github.com/ertug/kvm-jailbox) | QEMU, KVM, libvirt, private-network-isolation | Persistent per-project development VMs for coding agents on a plain libvirt/KVM stack: host nftables rules deny the guest every private address (host, LAN, other jailboxes, VPNs, cloud metadata) while internet access stays unrestricted, `clean-traffic` nwfilter drops IP/MAC spoofing at L2, and the device model is stripped (no graphics, USB, balloon, virtio channels, TPM, nested virt) to shrink VM-escape exposure. `kvm-jailbox check` verifies containment by port-scanning private addresses from inside the guest. See the [configuration guide](https://karamatli.com/posts/network-isolated-kvm-sandbox-ai-agents/). |
 | [Confidential Agents](https://confidential.ai/docs/api/confidential-agents) | SEV-SNP, TEE, attestation | Managed Confidential VM service for AI agents: AMD SEV-SNP hardware TEE isolation (host cannot inspect memory), attestation chain verifying hardware + TPM + inference gateway. Open-source [verification CLI](https://github.com/confidential-dot-ai/confidential-cvm-cli). |
 | [Sprites](https://sprites.dev/) | Firecracker, MicroVM, checkpoint-restore | Fly.io's managed Firecracker-based persistent Linux VMs for running coding agents or arbitrary code; checkpoint/restore in ~300ms, pre-installed with Claude Code and Codex CLI, API and CLI access. |
 | [InstaVM](https://instavm.io/) | MicroVM, egress-filtering, secrets-injection | Managed microVM sandboxes for AI agents: dedicated kernel per sandbox, default-deny egress with domain/CIDR allowlists, proxy-based secret injection (agents never see API keys), full execution logs and network traces. |