Drop sandbox for LinuxSkip to contentDrop
Documentation
CTRL K
GitHub

CTRL KDocumentation
Sandbox overviewInstallationRunningConfigurationgVisorEnvironment variablesTour: sandboxing ClaudeLightDark
System
Light

Dark

System
Linux sandboxing that doesn’t get in your wayIsolate programs and coding agents without leaving your familiar work environmentInstall DropUse cases
Isolate coding agentsRun agents with --dangerously-skip-permissions and let Drop enforce
permissions at the OS level. A hallucinated rm -rf ~ doesn’t touch
your actual home dir. A prompt injection targeting ~/.ssh finds
nothing. A connection to services running on localhost is rejected.Isolate third-party programsInstall programs from PyPI, npm or any other source without giving
them full access to your user account. If an installed program is
malicious or compromised in a supply chain attack, the damage is
contained within the sandbox.How it works
Disposable, isolated environmentsInspired by Python’s virtualenv, Drop lets you create and enter easily
disposable environments. Each environment has its own home
directory while the original home is hidden.Your existing distributionUnlike Docker/Podman, Drop uses your existing distribution, so there
is no container setup work: every program you’ve already installed is
available in the sandbox.Flexible config languageHigh-level TOML config lets you specify which files, dirs and local
network services should be exposed to the sandbox. By default, all Drop
environments share a base config, so you can configure Drop once and
then create new environments without any configuration work.RootlessDrop doesn’t require root to run. It runs within a Linux user
namespace, with its own process, mount, network, IPC and cgroup
namespaces. Drop drops all the user namespace capabilities before
executing a sandboxed program, so the program cannot do privileged
operations within the user namespace, like bind mounts.gVisor integrationAs an option, Drop supports running programs on the gVisor user-space
kernel. This is an additional isolation layer that prevents programs
from accessing the host kernel directly, significantly reducing
the potential to exploit kernel vulnerabilities.LightDark
System
Light

Dark

System
© 2026 Jan Wrobel

Drop provides a method for Linux sandboxing designed to isolate programs and coding agents without interfering with the user's familiar work environment. It serves the purpose of isolating applications and agents by enforcing permissions at the operating system level, mitigating risks associated with code execution. Use cases for Drop include isolating coding agents to prevent catastrophic accidental commands, such as ensuring that commands like rm -rf are contained within the sandbox and do not affect the actual home directory, and isolating connections to localhost services. Furthermore, Drop allows for the installation of third-party programs sourced from repositories like PyPI or npm, ensuring that any potential maliciousness or compromise stems only from the installed program and remains contained within the sandbox boundaries.

The mechanism of Drop relies on creating disposable and isolated environments, drawing inspiration from Python’s virtualenv concept. Each environment possesses its own distinct home directory, while the original user home directory is hidden, ensuring containment. Unlike container technologies such as Docker or Podman, Drop leverages the existing operating system distribution, eliminating the need for separate container setup procedures, as all previously installed programs are readily available within the sandbox. Configuration is managed through a high-level TOML configuration language, which allows users to precisely specify which files, directories, and local network services should be exposed to the sandboxed environment. A key design feature is the ability to share a base configuration, enabling users to define Drop settings once and subsequently create numerous new environments without redundant configuration work.

Drop operates in a rootless manner, meaning it does not require root privileges to execute. It functions within a Linux user namespace, managing its own dedicated process, mount, network, Inter-Process Communication, and cgroup namespaces. Before executing a sandboxed program, Drop drops all user namespace capabilities, effectively preventing the program from performing privileged operations within that namespace, such as bind mounts. Optionally, Drop integrates with gVisor, offering an additional layer of isolation by utilizing the gVisor user-space kernel. This integration serves to prevent programs from directly accessing the host kernel, thereby significantly reducing the potential attack surface related to kernel vulnerability exploitation.