jail-ai

# 🔒 jail-ai

A Rust-based jail wrapper for sandboxing AI agents using podman. Provides isolation, resource limits, and workspace management for secure AI agent execution.

[![Crates.io](https://img.shields.io/crates/v/jail-ai.svg)](https://crates.io/crates/jail-ai)
[![License](https://img.shields.io/badge/license-MIT%2FApache--2.0-blue.svg)](LICENSE)

## ✨ Features

- 🤖 **AI Agent Integration**: Pre-configured support for Claude Code, GitHub Copilot CLI, Gemini Agent, Gemini CLI, Codex CLI, Jules CLI, OpenCode, and Pi
- 🏗️ **Layered Container System**: Smart image building with automatic project type detection (Rust, Go, Node.js, Python, Java, PHP, C/C++, C#, Terraform, Kubernetes)
- ⚡ **Performance Optimizations**: LRU cache, batch operations, parallel builds, and background pre-fetching for faster execution
- 📦 **Nix Flakes Support**: Automatic detection and loading of Nix development environments
- 🔄 **Workspace Auto-mounting**: Current directory automatically mounted to `/workspace` in the jail
- 🔒 **Minimal Auth by Default**: Gemini auto-mounts only API credentials; other agents require explicit flags
- 🌍 **Environment Inheritance**: Automatically inherits `TERM`, timezone, and SSH agent socket
- 🔐 **Opt-in Git/GPG**: Enable git configuration and GPG signing with `--git-gpg` flag
- 🛡️ **Resource Limits**: Memory and CPU quota restrictions
- 🌐 **Network Isolation**: Configurable network access (disabled, private, or shared)
- 🔥 **eBPF-based Host Blocking**: Optional eBPF program to block container access to host IPs
- 📁 **Bind Mounts**: Support for read-only and read-write mounts

## 🚀 Installation

### Homebrew (macOS & Linux – recommended)

```bash
brew tap cyrinux/jail-ai https://github.com/cyrinux/jail-ai
brew install jail-ai
```

This installs the `jail-ai` binary, shell completions (bash/zsh/fish) and the man page.

**Container runtime (required):** pick one:

| Backend | Install | Platform |
|---------|---------|----------|
| **podman** | `br