Zerobox
Dev tools
sandboxing cli
SHOW HN2026
141points
93comments
#457of 4,366 in 2026
Top 11%of 2026 by points
How HN took it
CuriousMostly questions and neutral comments
7 positive, 23 neutral or asking, 3 mixed, 8 critical, out of 41 comments about the project. Thread score -0.01.
Idea: 5 for, 2 againstExecution: 0 for, 3 againstDocs: 0 for, 2 againstPrivacy: 1 for, 1 againstDesign: 1 for, 0 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Credential injection at the network proxy keeps secrets out of the sandboxed process
From 2 comments
the credential injection via MITM proxy is the most interesting part to me. the standard approach for agents is environment variables, which means the agent process can read them…
volume_tech on HNThis looks really good - the CLI interface design is solid, and I especially like the secrets / network proxy pattern - but the thing it needs most is copiously detailed…
simonw on HN
Deny-by-default network and file policy
From 1 comment
the credential injection via MITM proxy is the most interesting part to me. the standard approach for agents is environment variables, which means the agent process can read them…
volume_tech on HN
Low overhead, about 10ms cold start
From 2 comments
I added a benchmark test (Apple M5) and on average I'm seeing 10ms overhead. I added a benchmark section to the repo as well…
afshinmeh on HNZerobox uses the same kernel mechanisms (namespaces + seccomp) but no daemon, no root and cold start ~10ms (Docker is much worse in that regard). Docker gives you full filesystem…
afshinmeh on HN
Objections
Needs more documentation and testing evidence
From 3 comments
This looks really good - the CLI interface design is solid, and I especially like the secrets / network proxy pattern - but the thing it needs most is copiously detailed…
simonw on HNYou should probably add a huge disclaimer that this is an untested, experimental project. Related, a direct comparison to other sandboxes and what you offer over those would be…
wepple on HNWish it wasn’t rust… it’s so hard to read.
Lethalman on HN
Proxy-based domain filtering is best effort on macOS
From 1 comment
On macOS, the proxy is best effort. Programs that ignore HTTPS_PROXY/HTTP_PROXY can connect directly. This is a platform limitation (macOS Seatbelt doesn't support forced proxy…
afshinmeh on HN
Reliance on wrapping bubblewrap as a subprocess is questioned
From 1 comment
This is more a criticism of codex's linux-sandboxing, which you're just wrapping, but it's the first I've ever looked at it. I don't see how it makes sense to invoke bwrap as a…
nonameiguess on HN
Secrets passed on the command line are visible to other local processes
From 1 comment
> zerobox --secret OPENAI_API_KEY=$OPENAI_API_KEY Linux by default allows all users to read CLI arguments of running processes. While it looks like your bwrap invocation prevents…
lights0123 on HN
Requests
More detailed documentation of the sandbox mechanism and tests
From 2 comments
This looks really good - the CLI interface design is solid, and I especially like the secrets / network proxy pattern - but the thing it needs most is copiously detailed…
simonw on HNWish it wasn’t rust… it’s so hard to read.
Lethalman on HN
Debug and audit logging of blocked operations
From 2 comments
Cool project, and I think there would be a lot of value in just logging all operations.
alyxya on HNDoes Zerobox support audit logging for blocked network or file operations?
mina_jamshidian on HN
Docker usage guidance
From 1 comment
Hey - I'd love for you to add a documented / standard way to use this inside dockers so we can use build on it for various agentic efforts. I've solved getting bubblewrap to work…
rao-v on HN
Interactive profile building for reads
From 1 comment
That's a really tough question. I always worry about credentials that are tucked away in ~/.folders in my home directory like in ~/.aws - but you HAVE to provide access to some…
simonw on HN
Questions
How it compares to Docker and bubblewrap
From 2 comments
This is really useful! How well does it compare though to Docker etc. Because I am worried about sandbox escapes. This is what we currently use to sandbox JS inside Browsers and…
EGreg on HNPersonally I would probably always reach for a docker container if I want a sandboxed command that can run identically anywhere. I appreciate that alternate sandboxing tools can…
eluded7 on HN
How the proxy intercepts traffic and handles certificates on macOS
From 2 comments
How do you intercept network traffic on mac os? How do you fake certificates?
mdavid626 on HNYeah, but how does the sandboxed process “know” that it has to go through the proxy? How does it trust your certificate? Is the proxy fully transparent?
mdavid626 on HN
Whether it works inside containers
From 1 comment
Does this work inside of Podman containers?
solarkraft on HN
Alternatives named
Docker
From 2 comments
Personally I would probably always reach for a docker container if I want a sandboxed command that can run identically anywhere. I appreciate that alternate sandboxing tools can…
eluded7 on HNThis is really useful! How well does it compare though to Docker etc. Because I am worried about sandbox escapes. This is what we currently use to sandbox JS inside Browsers and…
EGreg on HN
bubblewrap
From 1 comment
Personally I would probably always reach for a docker container if I want a sandboxed command that can run identically anywhere. I appreciate that alternate sandboxing tools can…
eluded7 on HN
sandbox-exec
From 1 comment
I trust sandbox-exec more, or Docker on Linux. Those come from the OS, well tested and known. MITM proxy is nice idea to avoid leaking secrets. Isn’t it very brittle though?…
mdavid626 on HN
Deno sandboxing
From 1 comment
Thanks and agreed! Zerobox uses the Deno sandboxing policy and also the same pattern for cred injection (placeholders as env vars, replaced at network call time). Real secrets…
afshinmeh on HN