Show HN: Drop – a rootless Linux sandbox with gVisor support
4 hours ago
- Isolate coding agents and third-party programs without leaving your familiar work environment.
- Drop enforces permissions at the OS level, preventing damage from rm -rf, prompt injections targeting ~/.ssh, and connections to localhost services.
- Provides disposable, isolated environments inspired by Python’s virtualenv, each with its own home directory.
- Uses your existing Linux distribution, so no container setup is needed; all installed programs are available.
- High-level TOML config allows specifying which files, directories, and local network services are exposed to the sandbox.
- Rootless operation within a Linux user namespace, dropping all capabilities before executing sandboxed programs.
- Optional gVisor integration for an additional isolation layer to prevent direct host kernel access.