Show HN: Drop – a rootless Linux sandbox with gVisor support
New rootless Linux sandbox 'Drop' announced, using user namespaces and gVisor to isolate coding agents and third-party software from the host system.
A new open-source tool called Drop is announced, providing a rootless Linux sandbox environment with optional gVisor integration for isolating programs and coding agents. Drop leverages Linux user namespaces and optional gVisor kernel virtualization to contain potential damage from malicious software or supply chain attacks without requiring root access or a full container runtime like Docker. It aims to secure development workflows, particularly for AI agents and untrusted dependencies.
- Drop is a new rootless Linux sandbox tool for isolating programs and coding agents.
- It uses user namespaces and optionally gVisor for kernel-level isolation without Docker.
- Designed for isolating third-party software, npm/PyPI packages, and AI coding agents.
- Runs within the user's existing distribution, avoiding container setup overhead.
From the original article
1 min read at droprun.sh
Isolate programs and coding agents without leaving your familiar work environment Run agents with --dangerously-skip-permissions and let Drop enforce permissions at the OS level. A hallucinated rm -rf ~ doesn’t touch
By mixedbit · droprun.sh
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.