Show HN: Drop – a rootless Linux sandbox with gVisor support

Linux sandboxing that doesn’t get in your way

Isolate programs and coding agents without leaving your familiar work environment

Install Drop

Use cases

• Isolate coding agents

  Run agents with --dangerously-skip-permissions and let Drop enforce permissions at the OS level. A hallucinated rm -rf ~ doesn’t touch your actual home dir. A prompt injection targeting ~/.ssh finds nothing. A connection to services running on localhost is rejected.

• Isolate third-party programs

  Install programs from PyPI, npm or any other source without giving them full access to your user account. If an installed program is malicious or compromised in a supply chain attack, the damage is contained within the sandbox.

How it works

• Disposable, isolated environments

  Inspired by Python’s virtualenv, Drop lets you create and enter easily disposable environments. Each environment has its own home directory while the original home is hidden.

• Your existing distribution

  Unlike Docker/Podman, Drop uses your existing distribution, so there is no container setup work: every program you’ve already installed is available in the sandbox.

• Flexible config language

  High-level TOML config lets you specify which files, dirs and local network services should be exposed to the sandbox. By default, all Drop environments share a base config, so you can configure Drop once and then create new environments without any configuration work.

• Rootless

  Drop doesn’t require root to run. It runs within a Linux user namespace, with its own process, mount, network, IPC and cgroup namespaces. Drop drops all the user namespace capabilities before executing a sandboxed program, so the program cannot do privileged operations within the user namespace, like bind mounts.

• gVisor integration

  As an option, Drop supports running programs on the gVisor user-space kernel. This is an additional isolation layer that prevents programs from accessing the host kernel directly, significantly reducing the potential to exploit kernel vulnerabilities.