Security
What a Ringleader workstation's boundary prevents when a coding agent runs inside it, where each rule is enforced, and what it does not prevent.
A Ringleader workstation is a virtual machine of its own. On a Mac it runs under Apple’s
Virtualization framework (the vz provider), on a Windows PC under the Host Compute
Service (hcs), on Linux under qemu, and in your cloud account as an ordinary VM. The
coding agent you run inside it can do anything a developer with root could do, and that is
the point: the machine it can damage is one you can delete. Your own files are not inside
it unless you share a folder on purpose, and on vz and hcs it cannot reach your machine’s
services unless you carry one in.
The rules a security team cares about live outside the workstation, where nothing running inside it can change them, root included: where it may connect, which key is added to its requests on the way out, and which repositories it may clone. Once you declare them, that is where they are held. Two providers are the exception. A lima workstation on a Mac and a wsl2 workstation on Windows enforce none of this outside the machine.
For more information, Ringleader documentation covers the following security topics:
- Where the rules liveA rule about a workstation can live inside it, at its edge, or outside it.
- What is enforcedWhat a workstation enforces with nothing configured, and what you declare to have the rest enforced outside it.
- OWASP listsWhat a workstation's boundary does about each item on the OWASP MCP Top 10 and the OWASP Top 10 for Agentic Applications.
- What it does not preventThe limits of a workstation's boundary, in one place.