IronClaw blog¶
Long-form writing on running autonomous AI agents safely. Every post links its claims to shipped code, a versioned threat model, or a benchmark you can re-run yourself. No adjectives standing in for numbers.
Posts¶
- State of Container Isolation 2026: we graded 16 popular images and 15 scored a D or worse -
a reproducible survey of 16 popular public images in their common run
configurations, graded 0 to 100 with
ironctl scan. Only one hit an A; thirteen landed on a D. The median default image scores 48 of 100, running as root with the full capability set and a writable root filesystem. - We ran the same escape suite against Docker, gVisor, E2B, and Daytona - a reproducible containment benchmark. One fixed escape-attempt suite, scored by observed behavior. Raw Docker blocked 2 of 5, hardened runc 4 of 5, gVisor 5 of 5, with honest labels for the hosted platforms.
- Audit your sandbox in 10 seconds with ironctl scan - one command grades any container, compose service, or Kubernetes pod on a 0 to 100 containment scale. Fail-closed, works on your own setups. A wide-open container scores 23 of 100; a hardened IronClaw sandbox scores 100.
- Add a live Sandbox Isolation Score badge to your repo -
generate a shields.io endpoint JSON with
ironctl scan --badge-json, commit it as a static file, and render a live 0 to 100 A-to-F containment grade in your README. No server, no scan on every badge hit. - IronClaw scan is now a GitHub Action on the Marketplace -
add
uses: IronSecCo/ironclaw@v1to any workflow and every pull request gets a 0 to 100 sandbox isolation scorecard as a sticky comment. Same grader as the CLI: local, read-only, credential-free.
Hardening guides¶
Per-image, data-driven walkthroughs: the default isolation grade, the exact dimensions that
fail, and the precise ironctl scan --fix flags that close the gap, with before and after scores.
- How to harden a Postgres container -
postgres:17-alpinescores 48 of 100 (D) on defaults: root, full capabilities, writable rootfs. Four flags take it to 100 of 100 (A). Is it safe for untrusted workloads? - How to harden a Redis container -
redis:7-alpinescores 48 of 100 (D). A read-only rootfs and dropped capabilities take the classicCONFIG SET dirfile-write RCE off the table before auth. To 100 of 100 (A). - How to run untrusted Node.js code safely -
the container is the sandbox, not the
vmmodule.node:22-alpineis 48 of 100 (D) by default;network=noneplus five flags make it a 100 of 100 (A) boundary for untrusted JS. - How to harden an nginx container -
nginx:1.27-alpinescores 48 of 100 (D). The honest hardened ceiling for an internet-facing proxy is 89 of 100 (B), because it must reach its upstreams. Here is exactly why. - How to harden a MySQL container -
mysql:8.4scores 48 of 100 (D) on defaults: root, full capabilities, writable rootfs. Four flags take it to 100 of 100 (A). Is it safe for untrusted workloads? - How to harden an Elasticsearch container -
elasticsearch:8.16.1already runs non-root, so it starts at 63 of 100 (C). Three flags take a single-node index to 100 of 100 (A); a multi-node cluster has an honest 89 of 100 (B) ceiling. - How to harden a RabbitMQ container -
rabbitmq:4-alpinescores 48 of 100 (D). The honest hardened ceiling for a broker is 89 of 100 (B), because clients must be able to connect to it. Here is exactly why. - How to harden a Memcached container -
memcached:1.6-alpineruns non-root and holds nothing on disk, so it starts at 63 of 100 (C). A read-only rootfs (no volume needed) and dropped capabilities take it to its honest 89 of 100 (B). - How to harden a Cassandra container -
cassandra:5.0scores 48 of 100 (D) on defaults: root, full capabilities, writable rootfs. Four flags take a single-node ring to 100 of 100 (A); a gossiping cluster has an honest 89 of 100 (B) ceiling. - How to harden a ClickHouse container -
clickhouse:24.8scores 48 of 100 (D). Cutting egress closes its remote-table reach; four flags take the analytics store to 100 of 100 (A). - How to harden a Consul container -
hashicorp/consul:1.20scores 48 of 100 (D). The honest hardened ceiling for a service-mesh agent is 89 of 100 (B), because peers and clients must connect. Unlike Vault, it does not mlock by default. - How to harden a MinIO container -
minio/minioscores 48 of 100 (D). The honest hardened ceiling for an object store is 89 of 100 (B), because S3 clients must reach the API. Here is exactly why. - How to harden a Grafana container -
grafana/grafana:11.2.0already runs non-root, so it starts at 63 of 100 (C). The honest hardened ceiling for a dashboard server is 89 of 100 (B), because browsers must reach the UI. - How to harden a Prometheus container -
prom/prometheus:v3.1.0runs asnobody, so it starts at 63 of 100 (C). The honest hardened ceiling for a metrics server is 89 of 100 (B), because it must scrape targets and serve its API. - How to harden a Traefik container -
traefik:v3.2scores 48 of 100 (D). The honest hardened ceiling for an edge reverse proxy is 89 of 100 (B), because it exists to accept and forward traffic. Here is exactly why. - How to harden an InfluxDB container -
influxdb:2.7scores 48 of 100 (D). Four flags take a co-located time-series store to 100 of 100 (A); a fleet pushing metrics over the network has an honest 89 of 100 (B) ceiling. - How to scan a Dockerfile for security issues - a deliberately bad Dockerfile (root default, unpinned base, a baked-in secret) scores 5 of 100 (F) on a static, daemon-free scan. The exact one-line fixes take it to 100 of 100 (A).
Comparisons¶
Head-to-head reads, each backed by the same scan data, for the questions people actually search.
- Alpine vs Debian vs Ubuntu: does your base image change container isolation? - we scored the seven most-pulled base OS images. Every one landed on the same 48 of 100. Base image choice barely moves the isolation needle; runtime flags do.
- Docker default vs hardened: the container isolation score gap, measured - 151 images averaged 52 of 100 on defaults and 100 of 100 hardened. The exact 48-point jump, dimension by dimension, and the six flags that produce it.
- gVisor vs runc: container isolation compared - they score identically on a config scan yet block a different number of real escape attempts. When hardened runc is enough and when you need a user-space kernel.