Skip to main content
Back to challenges
Challenge

LangChain Hardware Sandbox Isolation & Resource Governor

Executing dynamic code generated by agents poses security and performance risks if sandbox cgroups and runtime CPU/GPU limits are not strictly enforced. Build a LangChain agent using LangGraph workflows that inspects sandbox containment mechanisms, audits hardware syscalls, and enforces dynamic resource throttling.

EngineeringHosted by Vera
Sign in free to start
Challenge brief

What you are building

The core problem, expected build, and operating context for this challenge.

Build a LangChain and LangGraph stateful governor that enforces cgroup memory limits and syscall containment on agent sandbox nodes.

Delivery guide

How work is evaluated

Evaluation

Evaluates the containment governor's ability to detect sandbox leaks and enforce cgroup limits.

Datasets

Challenge datasets

Public datasets, plus the private datasets you have access to.

Evaluation rubric

How submissions are scored

These dimensions define what the evaluator checks and which criteria separate a passable run from a strong one.

Dimensions
2 scoring checks
Binary
2 pass or fail dimensions
Ordinal
0 scaled dimensions
Dimension 1

enforcement_check

Ensures memory limits were enforced and illegal syscall blocked.

Binary check

This dimension contributes its full weight only when the submission satisfies the requirement. Partial credit is not awarded.

Dimension 2

containment_success_rate

Ratio of caught policy breaches versus total attack vectors • target: 1 • range: 0.95-1

Binary check

This dimension contributes its full weight only when the submission satisfies the requirement. Partial credit is not awarded.

Learning goals

What you should walk away with

  • Construct a stateful LangGraph state graph to monitor containerized agent sandboxes

  • Implement LangChain tools to inspect Linux cgroups v2 resource limits (memory, cpu, pids)

  • Audit unauthorized hardware syscalls and network socket binding attempts

  • Trigger runtime process isolation throttling when resource limits are breached

Resources and assets

Reference links and supporting material

Dataset notes

Container process telemetry including memory maps, cgroup stats, and seccomp syscall logs.

Challenge setup

Evaluates the containment governor's ability to detect sandbox leaks and enforce cgroup limits.

Challenge input

JSON containing target_pid, memory_limit_mb, requested_memory_mb, syscall_attempt

LangChain

Popular agent and tool integration library

Evaluated output

JSON containing process_status, cgroup_enforced, syscall_blocked, policy_action

Evaluation checks
  • Ensures memory limits were enforced and illegal syscall blocked.
  • Ratio of caught policy breaches versus total attack vectors • target: 1 • range: 0.95-1
Configured evaluation evidence
  • Benchmark: Container Security Benchmark (CIS)
  • Containment Success Rate target: 100%
  • 1 public reference case
Configured runtime
  • Python execution harness
  • Python sandbox (unavailable on Versalist)

Summary shows the first task, up to three tools, and up to three evidence items. Open the technical recipe to view all configured items.

View technical recipe

Configured tools

Action Space
  • Langchain · Required
  • LangChain · Optional
  • LangGraph · Optional
Orchestration
  • Langchain · Required
  • LangChain · Optional
  • LangGraph · Optional

Evaluation contract

  • enforcement_check · Weight 1
  • containment_success_rate · Weight 1

Metrics

  • containment_success_rate · Target 1

Benchmarks

  • Container Security Benchmark (CIS)
  • security

Reference cases

  • 1 public reference case

Workflow tasks

  1. Task 1

    Input: JSON containing target_pid, memory_limit_mb, requested_memory_mb, syscall_attempt

    Output: JSON containing process_status, cgroup_enforced, syscall_blocked, policy_action

    Execution harness: Python

Evaluation tools

  • LangChain · LLM Abstraction Framework

Recipe freeze marker

No recipe freeze time is recorded.

Frequently Asked Questions about LangChain Hardware Sandbox Isolation & Resource Governor