Skip to main content
HybridCloudWorks

Learn any cloudLabsWSL2 Container Sandbox for Coding Agents

WSL2 Container Sandbox for Coding Agents

WorkspacesUnknown

Supplementary Linux container simulation (no Windows 11 Azure VM): step into a rootless Linux container workspace that models a WSL2 Ubuntu distribution, inspect Dockerfile.agentic-wslc and /etc/wsl.conf isolation, and validate the Terraform harness offline.

Intermediateabout 25 minutesToolsaz, terraform

Run coding agents inside a rootless Ubuntu 24.04 container filesystem that mirrors a dedicated WSL2 distribution—mounting only the active project directory while keeping host credentials out of reach.

WSL2 & OCI Container Boundary — Rootless Agent Sandbox
Ubuntu 24.04 RootFSOffline Terraform MirrorNon-root UID 1000
OCI Image RootFS: hybridcloudworks/hcw-lab:latest

How it works

  1. The per-lab bootloader seeds ~/wsl-containers-lab with Dockerfile.agentic-wslc, verify-sandbox.sh, and a Terraform root.
  2. Run verify-sandbox.sh in bash to confirm the non-root user identity, isolated mount point, and baked-in provider mirror.
  3. Compare the Windows 11 wsl --import workflow with the running Linux container and validate main.tf offline.
Walk the flow

Key services

  • WSL2 Custom Distribution: Imports a clean container rootfs on Windows 11 via wsl --import
  • hybridcloudworks/hcw-lab: Pre-built Linux container image with Terraform and Azure CLI
  • Filesystem Provider Mirror: Allows terraform init -backend=false and validate with no network
Inspect services

Security and best practices

  • Mount only the target project directory (/workspace) instead of sharing your entire home directory with an agent.
  • Run coding agents as a non-root user inside a dedicated distribution or container so host profiles stay untouched.
  • Validate generated Terraform offline before introducing cloud credentials for a plan.
Open security deep dive

Outcome

A repeatable Linux sandbox pattern that works identically inside a browser container workspace, local Docker, or an imported WSL2 distribution on Windows 11.

Open implementation & cost

Opening your lab workspace…

Steps

  1. Step 1: Inspect the WSL2-equivalent container workspace

    The workspace opens directly in ~/wsl-containers-lab, seeded by the lab bootloader. List the files and read Dockerfile.agentic-wslc to see how the Ubuntu 24.04 rootfs is configured for a non-root user:

    ls -la ~/wsl-containers-lab
cat ~/wsl-containers-lab/Dockerfile.agentic-wslc

    The imported WSL distribution uses its own /etc/wsl.conf: Windows drive automount is disabled ([automount] enabled=false) and the default user is nobody ([user] default=nobody). It does not inherit Docker’s single-folder bind-mount boundary.

  2. Step 2: Run the sandbox boundary verification check

    Execute verify-sandbox.sh in bash to inspect the active Linux kernel, user identity, workspace mount, and offline provider mirror:

    ~/wsl-containers-lab/verify-sandbox.sh

    Confirm that User resolves to a non-root account and that TF_CLI_CONFIG_FILE points at the baked-in filesystem mirror.

  3. Step 3: Compare Windows 11 WSL2 import commands with local Docker execution

    On a Windows 11 workstation, you can export the container root filesystem and register it as a dedicated WSL2 distribution so an agent never touches your primary Ubuntu profile:

    docker create --name wslc-export hybridcloudworks/hcw-lab:latest
docker export wslc-export -o wslc-rootfs.tar
wsl --import hcw-agent-wslc "$env:LOCALAPPDATA\hcw-agent-wslc" .\wslc-rootfs.tar --version 2

    Because docker export + wsl --import does not carry Docker’s runtime user or bind mounts, the image bakes /etc/wsl.conf with automount disabled and default=nobody so /mnt/c host files are not exposed automatically.

  4. Step 4: Validate the Terraform harness offline

    Initialise and validate the Terraform configuration inside ~/wsl-containers-lab with the network backend disabled:

    cd ~/wsl-containers-lab
terraform init -backend=false
terraform fmt -check
terraform validate

    Send main.tf to the lab runner below to confirm the runner reaches the same offline validation result.

    Checked by the agent (terraform-validate): Paste ~/wsl-containers-lab/main.tf as the text payload: the runner initialises it from the offline provider mirror with no network access and runs terraform validate.