Drop: rootless Linux sandbox for safer third-party code execution
Developer releases Drop, a lightweight sandbox tool addressing security risks of running untrusted dependencies locally.
What to know
- Drop addresses a real pain point: developers need lightweight sandboxing for untrusted dependencies that doesn't impose VM/container overhead on local work.
- Multiple developers are independently building similar tools, suggesting strong market demand for this middle-ground security solution.
- Key questions remain unsettled: whether Drop offers security advantages over existing primitives, and what enterprise-grade solutions major AI labs actually use internally.
The dispute Whether Drop's rebuild of sandboxing primitives provides genuine advantages over composing existing tools like runc, bubblewrap, or gVisor directly. · positions read across 11 posts and comments
Drop solves a real productivity-security gap that existing solutions don't address well.
-
“For me, it nails the convenience vs isolation aspect quite well, and I would like to get to a point where I can use it for all my development by default.”
p2004a · Hacker News ↗
Drop's architectural independence from mature runtimes needs clearer justification of security or functional advantages.
-
“Personally I feel it is a bit light on the security differentiators (if any). For example you are using the same fundamental primitives that are used in nsjail, runc, etc.”
refibrillator · Hacker News ↗
Drop still has practical gaps that limit real-world adoption, particularly for containerized and GUI app development.
-
“The main challenges that I still have, which none of the solutions I've found so far resolve, are: development of containerized applications, where e.g., docker/podman compose is used to bring up services, development of GUI applications…”
p2004a · Hacker News ↗
mixedbit (Jan) Drop creatorp2004a Drop early userrefibrillator Developer working on parallel solution
How it unfolded 5 developments, newest first · click a bar or a number to jump articlespostscomments
-
5
Community members outline advanced sandboxing approaches and questions
Multiple commenters propose or request clarity on additional features (automatic HTTP proxy, profile composition) and note the absence of information about enterprise solutions used by major AI labs.
“What does Anthropic, OpenAI, SpaceXAI, Google and Amazon do in house to deal with the isolated agent environment problem?”
— programd -
As everyone mention, there are a lot of implementations of this idea, and not only for agent workflows.My own approach has the following features, hopefully that gets stolen into an actual softawre package at some point:- Generate bwrap options (for use in bwrap or gVisor) rather than build the sandbox itself. I wont't trust a random sandbox.- UDS…
2 more of the top 3 · 4 posts in this stretch
-
So there are a lot of ad-hoc solutions everybody is using for agent isolation and Drop looks well thought out. But the obvious question is what do the pros use? What does Anthropic, OpenAI, SpaceXAI, Google and Amazon do in house to deal with the isolated agent environment problem?Based on past experience I'm guessing everybody is using…
-
This is a really interesting middle ground between venvs and containers. How much overhead does gVisor add in practice for typical local development workloads?
-
-
4
Early user p2004a reports positive experience with Drop
An active user confirms Drop addresses the convenience-versus-isolation tradeoff well but identifies remaining challenges around containerized application development and GUI application support.
“For me, it nails the convenience vs isolation aspect quite well, and I would like to get to a point where I can use it for all my development by default.”
— p2004a -
Glad to see this coming with gVisor support to help secure the Kernel- IMHO we should expect frontier models to find Kernel exploits.I am working on a project similar in spirit that uses microsandbox (libkrun) to run inside a tiny and fast VM. It includes other security properties that are needed for some workloads. * network allow lists *…
1 more of the top 2 · 2 posts in this stretch
-
Can you explain a bit more about the boundary between the environment and my system? Is it just giving read-only access to /usr/lib?I use an alias to launch a Podman container with opencode in $PWD. It is fully ephemeral aside from the directories I map to it (usually a couple configs). XDG_HOME is local to that working dir. My only frustration is…
-
-
3
mixedbit explains technical decisions behind Drop's architecture
Creator clarifies why Drop was built as a standalone tool rather than layering on mature runtimes like runc or crun, citing scope limitations in OCI-compatible tools for Drop's specific requirements.
“These issues were certainly technically fixable, but it could be difficult for a new project with no usage to advocate for features in mature and widely adopted tools.”
— mixedbit -
Thanks! My initial approach and the first prototype was for Drop to be a Python script that generates config.json file for runc Docker runtime (I also tried crun). I ran into issues that prevented the sandbox from being set up with all the Drop-required properties. These issues were certainly technically fixable, but it could be difficult for a…
1 more of the top 2 · 2 posts in this stretch
-
Thank you for building it! I started using Drop a few weeks ago, and I've been very happy with it so far (thanks again for quickly fixing a few issues I've reported :)!).For me, it nails the convenience vs isolation aspect quite well, and I would like to get to a point where I can use it for all my development by default.The main challenges that I…
-
-
2
Developers report working on similar sandbox solutions
Comments reveal multiple engineers independently building comparable sandboxing tools, with several confirming the validation of the problem space and sharing their parallel approaches.
“Hi OP, funny enough I'm working on something very similar. Lots of us are I guess! Take that as validation of your thinking.”
— refibrillator -
This is super interesting to me. I've slowly been working on something similar (https://gitlab.com/saghm/tartarus) because my ideal sandboxing is "prevent writing to anything outside this dir but still allow reading to most things so that I don't have to manually copy things into a container/VM". I approached it by trying to figure out how to…
2 more of the top 3 · 3 posts in this stretch
-
Hi OP, funny enough I’m working on something very similar. Lots of us are I guess! Take that as validation of your thinking.I like that your readme has a couple paragraphs comparing to popular tools in this space. Personally I feel it is a bit light on the security differentiators (if any). For example you are using the same fundamental primitives…
-
Gratulacje Jan! Looks like something critical to gain adoption these days, security-wise. For others who also wonder how it works, I find this docs page a bit more informative than the landing page
-
-
1
mixedbit releases Drop sandbox tool on Hacker News
Developer introduces Drop, a rootless Linux sandbox supporting gVisor, created to mitigate risks of installing third-party programs. The motivation stems from concern that a single compromised dependency could compromise the entire system and potentially all users of software shipped from that machine.
“I created Drop because I always felt uneasy installing and running third-party programs using my main user account. A single compromised dependency means a full compromise of the system.”
— mixedbit -
first by HN Frontpage, 1d ago
-
What people are saying 1 voices from 1 site · best of 11 · verbatim
- What security differentiators does Drop offer compared to using runc, nsjail, or bubblewrap?
- How do major AI labs (Anthropic, OpenAI, Google) actually isolate agent execution in production?
- Can Drop be extended to support containerized application development and GUI applications?
- Yesterday
-
I don't see a difference to containers, which also use namespaces and make it easy to mount home as read only?