wardyn

Wardyn

The open-source governed-sandbox control plane for any workload — identity, controls, and audit are the product; the sandbox is a pluggable commodity. Anything you run under your own credentials inherits your full blast radius; Wardyn is the layer in between — per-run identity, credentials minted and revoked per run, one audited path off-host, no resident key. Coding agents are the flagship use.

Status: pre-alpha. Interfaces are not stable. Do not run production workloads. "Wardyn" is a working name — trademark clearance (USPTO full-text + org / domain / package handles) is still pending, so the name and the personal github.com/cjohnstoniv/wardyn module path may change before a 1.0.

Install

Two paths, neither needs a clone. Everything below pulls cosign-signed images with attested SBOMs — docs/VERIFY.md is how you check that.

On your machine — containerized control plane + UI:

curl -fsSL https://raw.githubusercontent.com/cjohnstoniv/wardyn/main/install.sh | sh

Docker is the only requirement. It installs into ~/.wardyn, mints this box's secret-store key locally, and starts the stack on http://127.0.0.1:8080. WARDYN_VERSION, WARDYN_HOME and WARDYN_PORT override the defaults.

On Kubernetes — the chart is a published OCI artifact:

WARDYN_VERSION=$(curl -fsSL https://api.github.com/repos/cjohnstoniv/wardyn/releases/latest \
                 | sed -n 's/.*"tag_name": *"v\([^"]*\)".*/\1/p')

helm install wardyn oci://ghcr.io/cjohnstoniv/charts/wardyn --version "$WARDYN_VERSION" \
  --namespace wardyn --create-namespace \
  --set auth.adminToken.secretRef.name=wardyn-auth

The chart needs an admin token or OIDC, a Postgres DSN, and an age identity — deploy/helm/wardyn/README.md covers each, plus admin/member RBAC, the Kubernetes runner substrate, SSH exposure and the full values table. Day-2 lives in docs/OPERATIONS.md. .claude/skills/wardyn-k8s-setup/ ships an agent-readable recipe for the same path, so a coding agent working in a clone can drive the install.

Building from source is a contributor path, not an install path — see CONTRIBUTING.md. If you want it anyway: clone, then make setup (which asks containerized vs host, and pulls published images unless WARDYN_BUILD_LOCAL=1).

That is the whole setup. The barrier is the only requirement — no model, no API key, no agent. Put the sandbox rules in a small YAML (or JSON) policy and hand it to one wardyn run — interactive or unattended:

wardyn run --agent claude-code --task-mode exec \
  --task 'echo hello from a governed sandbox' \
  --policy-file examples/policies/sandbox.yaml --wait

That runs a plain shell command in a governed sandbox: --task-mode exec means no agent and no model are involved at all. (--agent still names which sandbox image to launch — it is an image label, not a statement that an AI runs your task.) That file is a commented, sealed floor; wardyn policy render -f <file> checks it. --image brings your own base (docs/ENVBUILD.md); make compose-down stops everything.

Want an agent to write the code? Then connect a model — optional, and equally first-class at the CLI or in the UI:

claude setup-token | wardyn subscription connect   # subscription (never resident)
echo "$KEY"        | wardyn secret set anthropic-api-key   # API key
# Bedrock: WARDYN_BEDROCK_REGION/MODEL (+ WARDYN_BEDROCK_AWS_DIR for ~/.aws SSO)
wardyn setup status   # what's configured + the next command per unmet check

Skipping this is a supported end state, not an unfinished setup: setup status reports model access as optional and never as a gap to clear. Most of the built-in demos need no model either — see TRY-IT.md's "governance demo (no keys)".

Requirements

• Docker + compose v2 (Postgres rides in the compose file). Fence/CC1 needs nothing more; Wall/CC2 adds gVisor's runsc, Vault/CC3 /dev/kvm + Kata — wardyn setup wall|vault prints the steps for your host.
• Go 1.26+, Node 22 + pnpm 9 — only to build from source.
• go install …/cmd/wardyn@latest gives the CLI only; wardynd needs -tags docker + a built ui/dist — use make setup or the image.

What you get

Everything else — env and policy reference, deployment, sample workspaces — is indexed in docs/.

Watch it work

Thirteen narrated walkthroughs, about 72 minutes end to end. Every one drives the real console against real sandboxes — the policies are live, the refusals are real, and the audit rows on screen were written by the run you are watching. Start with 03a if you only watch one; it is the boundary itself.

The series uses a coding agent as its worked example, because that is the case most people arrive for. The mechanics on screen — the egress boundary, the credential brokering, the audit trail — are the same for any sandboxed workload.

They ship as release assets, not in the repo, so a clone stays small. Links pin v0.6.0; later releases re-publish under the same filenames.

Architecture at a glance

flowchart LR
  entry(["Human operator<br/>UI or wardyn CLI"])
  subgraph control["Control plane (trusted)"]
    wardynd["wardynd<br/>REST API + embedded UI<br/>policy · approvals · broker · audit"]
    pg[("Postgres<br/>append-only audit")]
    wardynd --> pg
  end
  subgraph sandbox["Per-run sandbox (UNTRUSTED) — gatewayless network"]
    %% rec declared first: else dagre routes the launch edge through it
    rec["wardyn-rec<br/>PTY recorder"]
    agent["Coding agent<br/>claude-code / codex-cli"]
    rec -->|"cast, brokered to wardynd"| proxy["wardyn-proxy<br/>L2 egress sidecar"]
    agent -->|"only path out"| proxy
  end
  entry --> wardynd
  wardynd -->|"launch (docker driver)"| agent
  proxy -->|"allowlisted L7, creds injected"| net(("Internet / APIs"))

A trusted control plane launches each run into an untrusted, gatewayless sandbox whose only path out is the wardyn-proxy sidecar, credentials injected there. Decision logs and masked casts flow back into the append-only audit log (THREAT-MODEL.md §8). Wardyn never adds power: a run reaches at most what you can, clamped by policy.

Honest security posture

What Wardyn does not defend against is published in full (THREAT-MODEL.md). Notable residuals:

• The model-API channel is an unavoidable data-exit path. Prompts and tool calls are logged; nothing stops an agent encoding data into a permitted prompt.
• Domain fronting and DNS-tunnel exfil need TLS interception, which ships only for operator-listed hosts (off by default) — most non-LLM egress stays opaque.
• CC1/Fence shares the host kernel, and the 1-hour minted-token window before revocation is minimized by TTL, never eliminated.
• The UI sandbox gateway defaults to a shared browser origin across runs, separated only by a path-scoped cookie, unless the operator sets a per-run origin template — the documented production default (UI-SANDBOXES.md).

Status

v0.6.0 (pre-alpha) is the current release, adding capability grants, Kubernetes as the base deployment story, wardyn ssh, governed UI sandboxes, member-owned workspaces and a hash-chained audit log. Two deployment lanes, both running real sandboxes, not one inverted into the other:

• deploy/compose — the local 10-minute trial. The only lane that runs on a laptop without a real cluster, and the only one with recorded demos (the Getting Started demo steps).
• Kubernetes: helm install wardyn oci://ghcr.io/cjohnstoniv/charts/wardyn --version <release> — the chart is published as a signed OCI artifact, so no clone and no helm repo add. See deploy/helm/wardyn — the deployment story: make kind-quickstart for a one-command real-cluster install, or a production Helm install onto your own Kubernetes. Not yet at Compose parity (see the chart README's "Known gaps").

Still unbuilt: SPIRE, OpenBao, an MCP gateway, arbitrary-domain TLS interception, OTLP/OCSF sinks, SAML/SCIM-provisioned team SSO, Compose's own L1 default-deny — see ROADMAP.md and CHANGELOG.md.

License and governance

Apache-2.0, and free for anyone to use for any purpose, commercial use included — at any scale, with no fee, no seat limit, no registration and no telemetry. There is no paid edition, no enterprise/ directory and no hosted backend: every control above is in this repo and runs on your infrastructure, or it doesn't run. There is also no CLA, which means no single party — including the maintainer — can relicense this project's accumulated work later.

LICENSING.md is the one page to hand your legal team: the grant, what the artifacts contain, redistribution obligations, patents, warranty, and the disclosed risks. TRADEMARKS.md covers what you may call things, which Apache-2.0 §6 deliberately does not.

Every published image is cosign-signed with an attested SBOM and build provenance — docs/VERIFY.md shows how to check that yourself.

Contributor sign-off via DCO (Signed-off-by). CNCF Sandbox is the governance target, not a status. Contributions welcome — see CONTRIBUTING.md.