sandboxed-step
Infrastructure
ci sandboxing
SHOW HN2025
85points
3comments
#844of 3,837 in 2025
Top 22%of 2025 by points
How HN took it
QuietFewer than 5 comments about the project
2 positive, 0 neutral or asking, 0 mixed, 0 critical, out of 2 comments about the project.
Idea: 1 for, 0 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Clean and easy way to use gVisor isolation for GitHub
From 1 comment
This is really nice. Clean and easy way to use gvisor isolation to solve a github problem. gvisor seems like the right level of isolation for a lot of code a dev would run on…
pa7ch on HN
Useful security tooling from its author
From 1 comment
How one person can be so good at putting out useful security tech is just wild. I'll add this to my pile of filo made security I consistently rely on
c45y on HN
Objections
GitHub Actions read-only steps still get cache write tokens, enabling cache poisoning
From 1 comment
> Surprisingly enough, GitHub Actions with read-only permissions still receive a cache write token, allowing cache poisoning, so they are not safe to run untrusted code. What are…
westurner on HN
Questions
What are solutions to cache poisoning in GitHub Actions and their tradeoffs
From 1 comment
> Surprisingly enough, GitHub Actions with read-only permissions still receive a cache write token, allowing cache poisoning, so they are not safe to run untrusted code. What are…
westurner on HN