Sandboxing MCP Server Execution: Containers to MicroVMs

graph TD
    Attacker[Indirect Prompt Injection] -->|Malicious Data Input| Host[AI Host Client: Cursor / Claude]
    Host -->|JSON-RPC tools/call: execute_command| Server[Unsandboxed MCP Server]
    
    subgraph Host Vulnerability Zone
        Server -->|System Call: execve| HostOS[Host Linux / macOS Kernel]
        HostOS --> AccessSecrets[Read ~/.ssh, ~/.aws, /etc/shadow]
        HostOS --> LateralPivot[Attack Internal Cloud Metadata: 169.254.169.254]
    end

# Hardened multi-stage build
FROM node:22-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

FROM node:22-alpine
WORKDIR /app

# Create unprivileged service user
RUN addgroup -S mcpuser -g 10001 && \
    adduser -S mcpuser -u 10001 -G mcpuser

COPY --from=builder /app/dist ./dist
COPY --from=builder /app/package*.json ./
COPY --from=builder /app/node_modules ./node_modules

# Enforce non-root execution
USER 10001:10001
ENV NODE_ENV=production

ENTRYPOINT ["node", "dist/index.js"]

#!/usr/bin/env bash
set -euo pipefail

# Run MCP server with maximum runtime isolation
docker run -i --rm \
  --name "mcp-sandbox-$(uuidgen | cut -d'-' -f1)" \
  --network none \
  --read-only \
  --tmpfs /tmp:rw,noexec,nosuid,size=64m \
  --cap-drop ALL \
  --security-opt no-new-privileges:true \
  --security-opt seccomp=/etc/docker/seccomp-mcp-strict.json \
  --pids-limit 64 \
  --memory 512m \
  --cpus 1.0 \
  -v /home/user/workspace/target-project:/workspace:ro \
  mcp-sandboxed:latest

graph TD
    App[MCP Server Container] -->|Syscalls: read, write, socket| gVisor[gVisor runsc Kernel: Sentry]
    gVisor -->|Virtual File System / Sandboxed Memory| HostKernel[Host Linux Kernel: KVM]
    gVisor --x|Blocked Unsafe Syscalls| HostKernel

# 1. Register gVisor RuntimeClass
apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata:
  name: gvisor
handler: runsc
---
# 2. Deploy Sandboxed MCP Pod
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mcp-untrusted-executor
  namespace: ai-sandbox
spec:
  replicas: 5
  selector:
    matchLabels:
      app: mcp-untrusted-executor
  template:
    metadata:
      labels:
        app: mcp-untrusted-executor
    spec:
      runtimeClassName: gvisor # Enforce gVisor kernel interception
      securityContext:
        runAsNonRoot: true
        runAsUser: 10001
        runAsGroup: 10001
        fsGroup: 10001
      containers:
        - name: executor
          image: registry.enterprise.internal/ai/mcp-python-runner:v2
          securityContext:
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
          resources:
            limits:
              cpu: "1.0"
              memory: "1Gi"
            requests:
              cpu: "250m"
              memory: "256Mi"
          volumeMounts:
            - name: ephem-tmp
              mountPath: /tmp
      volumes:
        - name: ephem-tmp
          emptyDir:
            medium: Memory
            sizeLimit: 128Mi

sequenceDiagram
    participant Host as MCP Orchestrator
    participant Jailer as Firecracker Jailer (chroot/cgroup)
    participant VM as Firecracker MicroVM (Guest OS)
    participant Tool as Tool Execution Handler

    Host->>Jailer: Spawn Jailed Firecracker Process
    Jailer->>VM: Boot Minimal Linux Kernel (4.14 / 5.10)
    Note over VM: Boot completed in 12ms
    Host->>VM: Pass JSON-RPC tools/call via vsock / Serial
    VM->>Tool: Execute Untrusted Code
    Tool-->>VM: Capture stdout / stderr
    VM-->>Host: Return JSON-RPC Execution Result
    Host->>Jailer: Terminate MicroVM (Zero residual state)

{
  "boot-source": {
    "kernel_image_path": "/var/lib/firecracker/vmlinux-5.10.bin",
    "boot_args": "console=ttyS0 reboot=k panic=1 pci=off init=/init quiet"
  },
  "drives": [
    {
      "drive_id": "rootfs",
      "path_on_host": "/var/lib/firecracker/mcp-rootfs.ext4",
      "is_root_device": true,
      "is_read_only": true
    },
    {
      "drive_id": "scratch",
      "path_on_host": "/tmp/scratch-session-981.ext4",
      "is_root_device": false,
      "is_read_only": false
    }
  ],
  "machine-config": {
    "vcpu_count": 1,
    "mem_size_mib": 256,
    "track_dirty_pages": false
  },
  "vsock": {
    "guest_cid": 3,
    "uds_path": "/tmp/firecracker-vsock.sock"
  }
}

# Launch inside chroot jail with dropped capabilities
firecracker-jailer \
  --id "mcp-vm-$(date +%s)" \
  --exec-file /usr/bin/firecracker \
  --uid 10001 \
  --gid 10001 \
  --chroot-base-dir /srv/jailer \
  -- \
  --config-file /var/lib/firecracker/vm-config.json

{
  "jsonrpc": "2.0",
  "id": "call-91823",
  "error": {
    "code": -32005,
    "message": "Security Sandbox Violation: Syscall 'connect' blocked by seccomp policy.",
    "data": {
      "violation_type": "BLOCKED_SYSCALL",
      "syscall": "sys_connect",
      "destination_ip": "169.254.169.254",
      "sandbox_tier": "gvisor-runsc",
      "remediation": "Outbound network connectivity from code execution tools is strictly prohibited."
    }
  }
}