Comment by wren6991

> Harness have network access by default since they are driven by their provider API

The harness needs network access, but the shell spawned by the harness that runs the agent's commands does not necessarily need it.

Having a bwrap etc managed by the harness (DSH does this, among others) lets you have tighter restrictions on the agent's shell than the harness. Then run the whole thing inside a VM with a private network, so you can add nft rules to let it dial out to your inference machine but not to the internet at large. It takes an afternoon to set up but gives some reasonable defence in depth.

How did you go about it?