↓ Skip to main content
tomrochette.com
  1. Agents/
  2. Sandboxing/

Drop

Author
glm-5.3-flash
History / Edit / PDF / EPUB / MD
Created: / Updated: / Status: finished / Readability: 3 / 5 minutes read (~833 words)
agent-curated 294 fully-ai-generated 392 isolation 6 linux 1 llm=glm-5.3-flash 291 open-source 79 research-note 264 sandboxing 13
Table of Contents

Drop is Jan Wrobel’s Apache-2.0, Go-based Linux sandbox that wraps any program or coding agent in a rootless environment built from your existing distribution: user, mount, PID, IPC, cgroup, and network namespaces plus dropped capabilities, with optional gVisor underneath and pasta networking that denies localhost services by default.

Drop’s bet is that isolation should not cost you your environment: it sandboxes inside the distribution you already run, no images and no VM required, and a 193-point launch says the gap between the thin wrappers and the VM tools was real.

What it is
#

A single prebuilt binary with a virtualenv-style workflow: drop init creates an environment with a TOML config, drop run starts a sandboxed shell in it, and environments are disposable while a shared base.toml means you configure once and spawn freely. The sandbox gets its own writable home directory while the original home is hidden, selected files and directories mount read-only, the current working directory is read-write with .git read-only, and your username is preserved, so every program you already installed just works. Underneath it uses your existing distribution rather than an image: namespaces isolate the process tree, all capabilities drop before exec so the sandboxed program cannot do privileged operations even within its own user namespace, and a mount namespace rearranges the root filesystem to hide the host. Networking runs through pasta with access to localhost services denied by default, and an optional gVisor mode stops sandboxed programs from issuing syscalls to the host kernel directly. The docs pitch two use cases: coding agents run with --dangerously-skip-permissions so a hallucinated rm -rf ~ or a prompt injection hunting ~/.ssh finds nothing, and third-party installs from PyPI or npm contained the way a supply-chain compromise deserves. Install is a curl of a release binary for amd64 or arm64 plus the passt/pasta package, with documented AppArmor configuration for Ubuntu 24+ and SELinux configuration for Fedora.

Status
#

Young tool, older project, one strong launch: 331 stars, 10 forks, 6 open issues as of 2026-09-29, created 2025-07-25, pushed 2026-09-28, latest release v0.2.1 on 2026-08-24. The Show HN thread on 2026-09-22 drew 193 points with substantive comparisons to bubblewrap and proot in the top replies. The repository sat for fourteen months before the launch found it its audience, so the traction is one good Hacker News day, not a community, and the maintainer list is one person.

Strengths
#

  • Keeps the working environment intact: host distro, installed tools, and username all survive the boundary, which neither a container nor a VM manages.
  • A real kernel boundary by default: six namespace types plus a full capability drop, with gVisor one flag away when the threat model warrants a user-space kernel.
  • Sensible defaults aimed at exactly this category’s threats: localhost denied, .git read-only, home hidden, ~/.ssh nonexistent.
  • The TOML base-plus-override config makes per-project policy cheap instead of per-invocation flags.

Cautions
#

  • Pre-1.0 (v0.2.1), solo-maintained, and fourteen months old with a community measured in one launch thread.
  • Namespace isolation shares the host kernel unless gVisor is enabled, which is the difference between containing a confused agent and containing a kernel exploit.
  • Distro hardening is on you: Ubuntu 24+ needs an AppArmor profile change and Fedora an SELinux one, and skipping either weakens the setup.
  • Linux-only (amd64 and arm64), with no macOS story at all, the opposite bet from Clawk.

Pricing
#

Free and open source under Apache-2.0; the only costs are the pasta dependency and the machine you run it on.

Compared to
#

  • aigate: the other wrapper-style column, but maintained, documented, and launched; choose aigate only as a reading exercise, Drop for actual use.
  • Clawk: trades the VM for namespaces, so Drop is lighter and keeps your Linux distro while Clawk is macOS-first and fully isolated.
  • OpenShell: NVIDIA’s runtime adds declarative egress policy and credential interception at an inference proxy; Drop hides the filesystem and blocks localhost but has no L7 policy layer, so pick OpenShell for organizational policy, Drop for a personal workstation.
  • Agent Sandbox: the Kubernetes answer when these workstation sandboxes need to become governed fleet infrastructure.

Bottom line
#

Recommended for Linux developers who want their coding agent fenced in by the kernel without giving up their installed environment, with gVisor enabled when the work is untrusted. Not for macOS, and not as a hardened boundary for hostile code until the solo-maintainer risk and the missing audit are priced in.

Changes
#

  • 2026-09-29 - Created from the entrant-resolution run, profiling the rootless namespace sandbox that uses the host distribution.

See also
#

References
#