Hacker News front page1 min readrelease notesintermediate
Show HN: Drop – a rootless Linux sandbox with gVisor support
Summary
Drop is a root‑less Linux sandbox that runs programs in a user‑namespace with isolated mount, network, IPC and cgroup namespaces. It reuses the host distribution’s binaries (no Docker image), provides disposable per‑project home directories, and is configured via a high‑level TOML file. An optional gVisor integration adds a user‑space kernel layer for extra kernel‑attack surface reduction. Use ca…
- Root‑less sandbox: runs entirely in a user namespace, no sudo required, drops namespace capabilities before exec.
- No container image: leverages the host’s existing packages, so any installed binary is immediately available inside the sandbox.
- Disposable environments get their own home directory; the real home is hidden, similar to Python virtualenv.
- Configuration via TOML lets you whitelist files, directories, and local network services per sandbox; a base config can be shared across environments.
Running untrusted code (e.g., AI coding agents, supply‑chain‑compromised packages) on a developer workstation traditionally requires heavyweight containers or VMs, which add friction and overhead. Drop offers a lightweight, root‑less alternative that integrates with the existing OS, reducing setup…
5/10
