Day 70: Project: Secure Coding-Agent Sandbox on ECS Fargate

Lab / Project: Secure Coding-Agent Sandbox on ECS Fargate

Project day. Build an ephemeral coding-agent sandbox on ECS Fargate: no prod credentials, locked egress, evidence bundle on exit. This is the reference isolation boundary for Implementer agents.

⚡ TL;DR: One task per run. Task role = sandbox only. Block IMDS tricks via hop limit + egress proxy. On stop, upload evidence.tar (events, diffs, junit, image digest).

Architecture

API → enqueue run → ECS RunTask (Fargate)
                     ├─ clone repo at SHA
                     ├─ agent loop (intents only)
                     ├─ unit tests
                     └─ upload evidence → S3 → stop

Task definition sketch

{
  "family": "coding-agent-sandbox",
  "networkMode": "awsvpc",
  "requiresCompatibilities": ["FARGATE"],
  "cpu": "1024",
  "memory": "2048",
  "taskRoleArn": "arn:aws:iam::123:role/agent-sandbox",
  "containerDefinitions": [{
    "name": "agent",
    "image": "123.dkr.ecr.us-east-1.amazonaws.com/agent@sha256:…",
    "environment": [
      {"name": "RUN_ID", "value": "REPLACE"},
      {"name": "AWS_EC2_METADATA_DISABLED", "value": "true"}
    ]
  }]
}

No prod creds

Sandbox may write only to an evidence bucket prefix. Deny iam:*, ssm:*, and prod account resources on the task role.

# launch
aws ecs run-task --cluster agents --task-definition coding-agent-sandbox \
  --network-configuration "awsvpcConfiguration={subnets=[subnet-x],securityGroups=[sg-y],assignPublicIp=DISABLED}" \
  --overrides '{"containerOverrides":[{"name":"agent","environment":[{"name":"RUN_ID","value":"run_7f3a"}]}]}'

Evidence on exit

tar -czf /tmp/evidence.tgz events.jsonl diff.patch junit.xml image-digest.txt
aws s3 cp /tmp/evidence.tgz s3://agent-evidence/run_7f3a/evidence.tgz

Acceptance criteria

• [ ] Digest-pinned image
• [ ] Task role cannot touch prod data
• [ ] Egress allowlist / proxy in place
• [ ] Evidence bundle uploaded
• [ ] Task stops (no long-lived workers)

Closing checklist

• [ ] Ephemeral Fargate tasks
• [ ] Sandbox IAM only
• [ ] Evidence bundle always
• [ ] Private subnets + controlled egress
• [ ] Correlate CloudTrail with run_id tags

Series navigation

Day 69: Policy as Code for Shell and Apply · Day 71: Token Budgets per PR and per Engineer

Last updated September 11, 2026