--- title: GitHub - earendil-works/gondolin: Experimental Linux... description: Gondolin is an open-source TypeScript SDK and CLI for running AI agent code inside fast local Linux micro-VMs (QEMU or experimental krun backend). It provides... canonical: https://daily.dev/posts/n59ezh35h twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GitHub - earendil-works/gondolin: Experimental Linux microvm setup with a TypeScript Control Plane as Agent Sandbox | daily.dev og:description: Gondolin is an open-source TypeScript SDK and CLI for running AI agent code inside fast local Linux micro-VMs (QEMU or experimental krun backend). It provides... og:url: https://daily.dev/posts/n59ezh35h og:image: https://api.daily.dev/og/posts/n59ezH35H.png og:image:alt: Post cover image og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GitHub - earendil-works/gondolin: Experimental Linux microvm setup with a TypeScript Control Plane as Agent Sandbox **[Matthew Laird](https://daily.dev/sources/u-uk0giik)** · [@hvk500](https://daily.dev/hvk500) · 11 upvotes · 0 comments ## Summary Gondolin is an open-source TypeScript SDK and CLI for running AI agent code inside fast local Linux micro-VMs (QEMU or experimental krun backend). It provides programmable HTTP/TLS egress policy with allowlists, secret injection without exposing credentials to the guest, custom VFS mounts, SSH support, disk snapshots, and ingress gateways. The control plane is written in TypeScript and policies can be customized via JavaScript. It targets the security risk of AI agents executing generated code that needs network access and credentials, isolating that code in disposable VMs while keeping network and filesystem access under host-side policy control. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Google Cloud: A Deep Dive into GKE Sandbox for Agents](https://daily.dev/posts/google-cloud-a-deep-dive-into-gke-sandbox-for-agents-keoxzofzg) · The New Stack · 3 upvotes · 0 comments - [Give your agents disposable environments in Go](https://daily.dev/posts/give-your-agents-disposable-environments-in-go-e2mg6p22c) · Tigris · 3 upvotes · 0 comments - [GitHub - yc-software/qm: Multiplayer agent harness for work](https://daily.dev/posts/github---yc-software-qm-multiplayer-agent-harness-for-work-y46pwxkg4) · Hacker News · 2 upvotes · 0 comments - [Open-Source Agent Sandbox Enables Secure Deployment of AI Agents on Kubernetes](https://daily.dev/posts/open-source-agent-sandbox-enables-secure-deployment-of-ai-agents-on-kubernetes-ichq19lcg) · InfoQ · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux), [#ai-agents](https://daily.dev/tags/ai-agents), [#infrastructure](https://daily.dev/tags/infrastructure), [#typescript](https://daily.dev/tags/typescript) [View this post on daily.dev](https://daily.dev/posts/n59ezh35h) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/n59ezh35h","headline":"GitHub - earendil-works/gondolin: Experimental Linux microvm setup with a TypeScript Control Plane as Agent Sandbox","text":"Shared: GitHub - earendil-works/gondolin: Experimental Linux microvm setup with a TypeScript Control Plane as Agent Sandbox","url":"https://daily.dev/posts/n59ezh35h","datePublished":"2026-07-26T18:34:00.979Z","dateModified":"2026-09-14T07:39:41.833Z","author":{"@type":"Person","name":"Matthew Laird","url":"https://daily.dev/hvk500","image":"https://avatars0.githubusercontent.com/u/14907718?v=4","description":"Passionate developer, reliability engineer, maker and drinker of coffee.","worksFor":{"@type":"Organization","name":"MagicOrange","logo":"https://www.google.com/s2/favicons?domain=magicorange.com\u0026sz=128"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":13355}},"image":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":11},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"sharedContent":{"@type":"WebPage","url":"https://api.daily.dev/r/YjjPqtqrz"},"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/u-uk0giik","name":"Matthew Laird"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Matthew Laird","item":"https://daily.dev/sources/u-uk0giik"},{"@type":"ListItem","position":3,"name":"GitHub - earendil-works/gondolin: Experimental Linux microvm setup with a TypeScript Control Plane as Agent Sandbox"}]} ```