Jan Wrobel released Drop, a rootless Linux sandbox for isolating coding agents from the developer's home directory, and it reached 123 points on Show HN in about five hours

A coding agent with permissions skipped can wipe a home directory on the first hallucination. Jan Wrobel released Drop, a rootless Linux sandbox for isolating coding agents and third-party packages, and the Show HN post reached 123 points in about five hours. The repository at wrr/drop shows 148 stars on GitHub, Apache 2.0 licensed, and lists the intended use case in one line on the landing page: "Run agents with --dangerously-skip-permissions and let Drop enforce permissions at the OS level."

What the sandbox actually stops

Drop's own examples are concrete. A hallucinated rm -rf ~ does not touch the real home directory, because the sandbox hides it and substitutes its own. A prompt injection that targets ~/.ssh finds nothing to read. A connection from inside the sandbox to a service running on localhost is refused. Drop describes the second use case as installing programs from PyPI, npm or any other source without giving them full access to the user account, so a supply-chain compromise inside a package stays contained.

How it works

Drop borrows the shape of Python's virtualenv: each environment is disposable, has its own home directory, and hides the original. The mechanism underneath is a Linux user namespace with its own process, mount, network, IPC and cgroup namespaces. Drop drops the user namespace capabilities before running the sandboxed program, so the program cannot perform privileged operations such as bind mounts inside the namespace.

Unlike Docker or Podman, Drop uses the developer's existing distribution rather than a container image, so every program already installed on the machine is available inside the sandbox. Configuration is a TOML file that lists which files, directories and local network services to expose. A base config is shared across environments, so a team configures Drop once and then spins up new environments without more setup work.

The optional extra: gVisor

For a stronger boundary, Drop can run programs on gVisor, a user-space kernel written by Google that intercepts syscalls and stops programs from touching the host kernel directly. That reduces the reachable surface for kernel exploits at the cost of some performance. Drop makes gVisor optional, so a team can opt in per project.

What to check before adopting it

Drop is Linux only, which rules out the many teams whose coding-agent workflow runs on macOS or in a dev container inside a Mac. The Show HN traction is real, but the star count is still small, so the sample of teams reporting production use is small too. For a team already running unattended coding agents on a Linux host, the guarantee that a bad turn cannot reach the developer's SSH keys or ambient credentials is exactly the guarantee most previous sandboxes could not make without a container that took the developer's tools away.

Source

Jan Wrobel, Drop: Linux sandboxing that doesn't get in your way, site launched September 2026. Repository: wrr/drop. Show HN discussion: Show HN: Drop, a rootless Linux sandbox with gVisor support, 22 September 2026.