all posts
blog · topic

Security, isolation and multi-tenancy

When the code in a sandbox is hostile, the isolation boundary is the product. These posts cover hardware versus kernel-level isolation, multi-tenant platform design, prompt injection and supply-chain attacks against agents, egress control, and the evidence auditors ask for.

PandaStack security

312 posts

·11 min read

Every In-Process Python Sandbox Leaks, and the Reason Is Structural

Removing a name from a namespace removes a name, not reachability. CPython's object graph has no partitions, and `ctypes` is a documented feature whose purpose is calling arbitrary native code. Here is where the boundary actually has to go.

pythonsandboxingrestrictedpython
Ajay Kumar
·11 min read

Encryption at Rest for Sandbox Disks and Snapshots

"Is customer data encrypted at rest?" is one checkbox covering four very different files, three of which are not what the reviewer is picturing. One of them is a verbatim copy of someone's RAM.

encryption-at-restsecuritysnapshots
Ajay Kumar
·11 min read

Pickle Is a Virtual Machine You Have Been Downloading

pickle is a stack machine with an eval loop, and you have been downloading it from the internet as model weights. Here is the disassembly, why the allowlist promises less than it looks, and the conversion gateway that fixes it once instead of forever.

pickledeserializationpython
Ajay Kumar
·11 min read

Giving an AI Agent a Language Server: The Index Is Code Execution

An agent that edits code by grepping and guessing is the agent everyone complains about. A language server fixes that — and quietly runs the repository's build scripts to do it. So run the indexer in a microVM, snapshot the warm index, and restore it per session.

ai-agentslanguage-serverlsp
Ajay Kumar
·9 min read

Where to Run devcontainer.json in 2026

devcontainer.json names an image, layers features, forwards ports and runs lifecycle commands. It has no field describing what the workspace is isolated from — so two fully compliant platforms can hand you completely different blast radii from a byte-identical file.

devcontainersdev-container-speccloud-dev-environments
Ajay Kumar
·11 min read

Top 10 Throwaway psql Platforms for Engineers (2026)

Everyone benchmarks create latency. Nobody benchmarks the part engineers actually wait on, which is the seed. A database you can create in two seconds and must then load 40 GB into is a twenty-minute database -- so grade these ten on the provisioning verb instead.

comparisonpostgresdatabases
Ajay Kumar
·11 min read

Parsing Untrusted XML: The Format That Ships an Interpreter

An external entity is a documented feature that makes the parser read files and open sockets for whoever wrote the document. XXE is not a defect; it is conformance with the wrong author. So stop treating a flag as a boundary.

xmlxxeuntrusted-input
Ajay Kumar
·11 min read

Per-Tenant Audio and DSP Rendering in MicroVMs: The Plugin Is the Payload

Audio platforms have the same shape as render farms, plus one property that changes everything: the thing a customer uploads is often not data, it is a shared library, and hosting it means loading it into your renderer's address space.

audiodspmulti-tenant
Ajay Kumar
·11 min read

Running a Multi-Tenant Render Farm on MicroVMs: A .blend File Is a Program

If strangers send you scene files and render flags, you are not running a render farm. You are running a code-execution platform that happens to produce images, and the boundary you picked for "just rendering" is now load-bearing.

render-farmblendermulti-tenant
Ajay Kumar

More posts in this topic