Drop is a rootless Linux sandbox aimed at isolating coding agents and third-party programs, with OS-level permissions, optional gVisor support, and a workflow that stays close to a normal shell.

Linux sandboxing that doesn’t get in your way

Isolate programs and coding agents without leaving your familiar work environment

Install Drop

Use cases

Isolate coding agents

Run agents with --dangerously-skip-permissions and let Drop enforce permissions at the OS level. A hallucinated rm -rf ~ doesn’t touch your actual home dir. A prompt injection targeting ~/.ssh finds nothing. A connection to services running on localhost is rejected.

Isolate third-party programs

Install programs from PyPI, npm or any other source without giving them full access to your user account. If an installed program is malicious or compromised in a supply chain attack, the damage is contained within the sandbox.

How it works

Disposable, isolated environments

Inspired by Python’s virtualenv, Drop lets you create and enter easily disposable environments. Each environment has its own home directory while the original home is hidden.

Your existing distribution

Unlike Docker/Podman, Drop uses your existing distribution, so there is no container setup work: every program you’ve already installed is available in the sandbox.

Flexible config language

High-level TOML config lets you specify which files, dirs and local network services should be exposed to the sandbox. By default, all Drop environments share a base config, so you can configure Drop once and then create new environments without any configuration work.

Rootless

Drop doesn’t require root to run. It runs within a Linux user namespace, with its own process, mount, network, IPC and cgroup namespaces. Drop drops all the user namespace capabilities before executing a sandboxed program, so the program cannot do privileged operations within the user namespace, like bind mounts.

gVisor integration

As an option, Drop supports running programs on the gVisor user-space kernel. This is an additional isolation layer that prevents programs from accessing the host kernel directly, significantly reducing the potential to exploit kernel vulnerabilities.