gvisor

Show HN: Drop – a rootless Linux sandbox with gVisor supportdroprun.sh

Drop is a root‑less Linux sandbox that runs programs in a user‑namespace with isolated mount, network, IPC and cgroup namespaces. It reuses the host distribution’s binaries (no Docker image), provides disposable per‑project home directories, and is configured via a high‑level TOML file. An optional gVisor integration adds a user‑space kernel layer for extra kernel‑attack surface reduction. Use ca…