[{"data":1,"prerenderedAt":519},["ShallowReactive",2],{"project-47574871":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":35,"aspects":36,"strip":47,"post_text":48,"what":49,"said":92,"maker_in_thread":230,"shape":241,"grid":245,"attempts":481,"same_week":482,"maker_shows":232,"maker_hidden":511,"reader_version":512,"card":513},"47574871","Zerobox","Sandbox any command with file, network, credential controls","title","Show HN: Zerobox – Sandbox any command with file, network, credential controls","https:\u002F\u002Fgithub.com\u002Fafshinm\u002Fzerobox","github.com","afshinmeh",1774881156,2026,141,93,457,4366,11,"notable","dev_tools","sandboxing cli","cli",[24,25,26,27],"sandbox","process isolation","credential injection","network proxy","curious",-0.011,{"positive":31,"neutral":32,"mixed":33,"critical":34},7,23,3,8,41,{"docs":37,"privacy":40,"execution":42,"design":43,"idea":44,"performance":46},{"positive":38,"critical":39},0,2,{"positive":41,"critical":41},1,{"positive":38,"critical":33},{"positive":41,"critical":38},{"positive":45,"critical":39},5,{"positive":38,"critical":38},[33,38,33,38,41,33,45,33,33,33,33,33,38,45,41,41,33,33,45,33,41,33,33,33,38,41,45,33,33,33,38,41,33,33,45,38,38,33,38,38],null,{"problem":50,"audience":48,"pricing":48,"motivation":61,"time_to_build":48,"stack":65,"openness":90,"stage":91,"team_size":91},{"value":51,"source":52,"evidence":53},"Restricting what an arbitrary command can read, write, or reach over the network, and keeping secrets out of the sandboxed process","maker",[54,57],{"id":55,"by":11,"text":56},"47583022","I'm excited to introduce Zerobox, a cross-platform, single binary process sandboxing CLI written in Rust. It uses the sandboxing crates from the OpenAI Codex repo and adds…",{"id":58,"by":59,"text":60},"47604552","volume_tech","the credential injection via MITM proxy is the most interesting part to me. the standard approach for agents is environment variables, which means the agent process can read them…",{"value":62,"source":52,"evidence":63},"Sandboxing AI agents and tools run locally, where network and file access need limits",[64],{"id":55,"by":11,"text":56},[66,70,77,81],{"value":67,"source":52,"evidence":68},"Rust",[69],{"id":55,"by":11,"text":56},{"value":71,"source":52,"evidence":72},"OpenAI Codex sandboxing crates",[73,76],{"id":74,"by":11,"text":75},"47604495","I agree to some extend. I'm using the OpenAI Codex crates for sandboxing though, which I think it's properly tested? They launched last year and iterated many times. I will add a…",{"id":55,"by":11,"text":56},{"value":78,"source":52,"evidence":79},"bubblewrap on Linux",[80],{"id":55,"by":11,"text":56},{"value":82,"source":52,"evidence":83},"seatbelt on macOS",[84,87],{"id":85,"by":11,"text":86},"47604545","That's right. It uses the same kernel mechanisms as Docker, the runtime is different though (bwrap on linux, seatbelt on mac, etc.)",{"id":88,"by":11,"text":89},"47604754","Thanks for sharing that. Zerobox _does_ use the native OS sandboxing mechanisms (e.g. seatbelt) under the hood. I'm not trying to reinvent the wheel when it comes to sandboxing.…","open_source","unknown",{"praise":93,"objections":116,"requests":149,"questions":179,"alternatives":208},[94,103,107],{"value":95,"source":96,"evidence":97},"Credential injection at the network proxy keeps secrets out of the sandboxed process","commenter",[98,99],{"id":58,"by":59,"text":60},{"id":100,"by":101,"text":102},"47604487","simonw","This looks really good - the CLI interface design is solid, and I especially like the secrets \u002F network proxy pattern - but the thing it needs most is copiously detailed…",{"value":104,"source":96,"evidence":105},"Deny-by-default network and file policy",[106],{"id":58,"by":59,"text":60},{"value":108,"source":52,"evidence":109},"Low overhead, about 10ms cold start",[110,113],{"id":111,"by":11,"text":112},"47604408","I added a benchmark test (Apple M5) and on average I'm seeing 10ms overhead. I added a benchmark section to the repo as well…",{"id":114,"by":11,"text":115},"47605778","Zerobox uses the same kernel mechanisms (namespaces + seccomp) but no daemon, no root and cold start ~10ms (Docker is much worse in that regard). Docker gives you full filesystem…",[117,129,135,142],{"value":118,"source":96,"evidence":119},"Needs more documentation and testing evidence",[120,121,125],{"id":100,"by":101,"text":102},{"id":122,"by":123,"text":124},"47604394","wepple","You should probably add a huge disclaimer that this is an untested, experimental project. Related, a direct comparison to other sandboxes and what you offer over those would be…",{"id":126,"by":127,"text":128},"47606104","Lethalman","Wish it wasn’t rust… it’s so hard to read.",{"value":130,"source":52,"evidence":131},"Proxy-based domain filtering is best effort on macOS",[132],{"id":133,"by":11,"text":134},"47605884","On macOS, the proxy is best effort. Programs that ignore HTTPS_PROXY\u002FHTTP_PROXY can connect directly. This is a platform limitation (macOS Seatbelt doesn't support forced proxy…",{"value":136,"source":96,"evidence":137},"Reliance on wrapping bubblewrap as a subprocess is questioned",[138],{"id":139,"by":140,"text":141},"47605108","nonameiguess","This is more a criticism of codex's linux-sandboxing, which you're just wrapping, but it's the first I've ever looked at it. I don't see how it makes sense to invoke bwrap as a…",{"value":143,"source":96,"evidence":144},"Secrets passed on the command line are visible to other local processes",[145],{"id":146,"by":147,"text":148},"47606505","lights0123","> zerobox --secret OPENAI_API_KEY=$OPENAI_API_KEY Linux by default allows all users to read CLI arguments of running processes. While it looks like your bwrap invocation prevents…",[150,155,166,173],{"value":151,"source":96,"evidence":152},"More detailed documentation of the sandbox mechanism and tests",[153,154],{"id":100,"by":101,"text":102},{"id":126,"by":127,"text":128},{"value":156,"source":96,"evidence":157},"Debug and audit logging of blocked operations",[158,162],{"id":159,"by":160,"text":161},"47603903","alyxya","Cool project, and I think there would be a lot of value in just logging all operations.",{"id":163,"by":164,"text":165},"47606925","mina_jamshidian","Does Zerobox support audit logging for blocked network or file operations?",{"value":167,"source":96,"evidence":168},"Docker usage guidance",[169],{"id":170,"by":171,"text":172},"47607742","rao-v","Hey - I'd love for you to add a documented \u002F standard way to use this inside dockers so we can use build on it for various agentic efforts. I've solved getting bubblewrap to work…",{"value":174,"source":96,"evidence":175},"Interactive profile building for reads",[176],{"id":177,"by":101,"text":178},"47604721","That's a really tough question. I always worry about credentials that are tucked away in ~\u002F.folders in my home directory like in ~\u002F.aws - but you HAVE to provide access to some…",[180,191,201],{"value":181,"source":96,"evidence":182},"How it compares to Docker and bubblewrap",[183,187],{"id":184,"by":185,"text":186},"47605694","EGreg","This is really useful! How well does it compare though to Docker etc. Because I am worried about sandbox escapes. This is what we currently use to sandbox JS inside Browsers and…",{"id":188,"by":189,"text":190},"47604114","eluded7","Personally I would probably always reach for a docker container if I want a sandboxed command that can run identically anywhere. I appreciate that alternate sandboxing tools can…",{"value":192,"source":96,"evidence":193},"How the proxy intercepts traffic and handles certificates on macOS",[194,198],{"id":195,"by":196,"text":197},"47604891","mdavid626","How do you intercept network traffic on mac os? How do you fake certificates?",{"id":199,"by":196,"text":200},"47605102","Yeah, but how does the sandboxed process “know” that it has to go through the proxy? How does it trust your certificate? Is the proxy fully transparent?",{"value":202,"source":96,"evidence":203},"Whether it works inside containers",[204],{"id":205,"by":206,"text":207},"47618593","solarkraft","Does this work inside of Podman containers?",[209,214,218,224],{"value":210,"source":96,"evidence":211},"Docker",[212,213],{"id":188,"by":189,"text":190},{"id":184,"by":185,"text":186},{"value":215,"source":96,"evidence":216},"bubblewrap",[217],{"id":188,"by":189,"text":190},{"value":219,"source":96,"evidence":220},"sandbox-exec",[221],{"id":222,"by":196,"text":223},"47604725","I trust sandbox-exec more, or Docker on Linux. Those come from the OS, well tested and known. MITM proxy is nice idea to avoid leaking secrets. Isn’t it very brittle though?…",{"value":225,"source":52,"evidence":226},"Deno sandboxing",[227],{"id":228,"by":11,"text":229},"47604589","Thanks and agreed! Zerobox uses the Deno sandboxing policy and also the same pattern for cred injection (placeholders as env vars, replaced at network call time). Real secrets…",{"comments":231,"answered":232,"key":233},37,13,[234,237,240],{"id":235,"text":236},"47604506","Simon! Thanks. I appreciate your comment and totally agreed. I will improve the docs as well as tests.",{"id":238,"text":239},"47605830","Ohh! thanks for sharing this. You are using DNS proxy which is interesting and useful if a process doesn't respect the HTTPS_PROXY\u002FHTTP_PROXY\u002Fetc. env vars that I'm injecting. I…",{"id":74,"text":75},{"commenters":231,"max_depth":242,"maker_replies":231,"first_comment_mins":243,"lifespan_hours":244},12,885,353,[246,248,250,254,256,258,261,265,269,271,273,275,278,281,283,286,290,292,295,297,299,301,302,303,307,308,312,315,317,322,323,327,330,332,337,339,341,343,346,348,350,352,354,355,357,359,361,364,366,369,371,372,373,374,376,377,379,382,384,386,387,390,392,393,396,400,402,405,407,409,411,413,415,419,421,423,428,431,433,435,437,439,441,443,447,450,451,453,455,458,460,462,464,466,470,472,474,476,478],[100,38,33,247,101,38],"project\u002Fmixed\u002Fdocs",[235,38,38,249,11,41],"maker\u002Fpositive\u002Fdocs",[251,38,38,252,253,38],"47604585","commenter\u002Fneutral\u002Fnone","kjok",[255,38,38,252,101,38],"47604626",[257,38,38,252,253,38],"47605031",[259,38,38,252,260,38],"47608124","cyanydeez",[262,41,33,263,264,38],"47762392","project\u002Fneutral\u002Fprivacy","kvikuz",[266,39,38,267,268,38],"47605801","other\u002Fneutral\u002Fnone","smallerfish",[238,39,38,270,11,41],"maker\u002Fpositive\u002Fnone",[122,33,41,272,123,38],"project\u002Fcritical\u002Fdocs",[74,33,38,274,11,41],"project\u002Fneutral\u002Fexecution",[139,276,41,277,140,38],4,"project\u002Fcritical\u002Fexecution",[279,276,38,280,11,41],"47605326","maker\u002Fneutral\u002Fexecution",[282,276,33,274,101,38],"47605889",[284,276,38,285,11,41],"47606305","maker\u002Fneutral\u002Fnone",[287,45,45,288,289,38],"47611931","project\u002Fpositive\u002Fdesign","Gerharddc",[291,45,38,270,11,41],"47612802",[170,293,33,294,171,38],6,"project\u002Fneutral\u002Fdocs",[296,293,38,285,11,41],"47607803",[298,293,33,274,171,38],"47608509",[184,31,33,300,185,38],"project\u002Fneutral\u002Fidea",[114,31,38,300,11,41],[188,34,33,300,189,38],[304,34,33,305,306,38],"47604163","project\u002Fneutral\u002Fnone","ebb_earl_co",[85,34,38,274,11,41],[309,34,33,310,311,38],"47606212","project\u002Fmixed\u002Fexecution","hrmtst93837",[313,34,38,252,314,38],"47607736","sebmellen",[316,34,38,252,311,38],"47610990",[318,319,33,320,321,38],"47604140",9,"project\u002Fneutral\u002Fperformance","time0ut",[111,319,38,320,11,41],[324,319,38,325,326,38],"47605701","other\u002Fneutral\u002Fperformance","qalfy",[328,319,38,329,11,41],"47607493","maker\u002Fneutral\u002Fperformance",[331,319,38,320,11,41],"47606614",[333,334,45,335,336,38],"47606060",10,"project\u002Fpositive\u002Fidea","jwilliams",[338,334,38,285,11,41],"47606259",[146,18,41,340,147,38],"project\u002Fcritical\u002Fprivacy",[342,18,38,263,11,41],"47606645",[344,242,41,277,345,38],"47604258","jbverschoor",[347,242,33,274,101,38],"47604525",[349,242,38,274,11,41],"47604564",[351,242,33,263,101,38],"47604613",[353,242,38,285,11,41],"47604653",[177,242,33,300,101,38],[356,242,38,300,11,41],"47604776",[358,242,45,335,101,38],"47605110",[360,242,38,285,11,41],"47605168",[362,242,33,300,363,38],"47609340","gslepak",[365,242,38,285,11,41],"47612847",[367,242,33,368,363,38],"47616326","project\u002Fneutral\u002Fdesign",[370,242,38,285,11,41],"47604533",[222,232,41,277,196,38],[88,232,38,274,11,41],[195,232,33,274,196,38],[375,232,38,274,11,41],"47605079",[199,232,33,274,196,38],[378,232,38,274,11,41],"47605153",[380,232,33,274,381,38],"47605351","blanched",[383,232,38,274,11,41],"47605666",[385,232,33,274,101,38],"47605826",[133,232,38,274,11,41],[388,232,38,389,101,38],"47605928","commenter\u002Fneutral\u002Fexecution",[391,232,38,274,11,41],"47606034",[205,232,33,274,206,38],[394,232,41,395,196,38],"47605087","project\u002Fcritical\u002Fidea",[397,398,45,335,399,38],"47624597",14,"nwlsrb",[159,401,45,335,160,38],15,[403,401,33,300,404,38],"47604147","kimixa",[406,401,33,300,160,38],"47604802",[408,401,38,285,11,41],"47604856",[410,401,33,300,404,38],"47606923",[412,401,38,300,11,41],"47607014",[414,401,38,274,11,41],"47604374",[416,417,33,300,418,38],"47605999",16,"dk8996",[420,417,38,300,11,41],"47606015",[422,417,38,300,11,41],"47624122",[424,425,38,426,427,38],"47605370",17,"other\u002Fneutral\u002Fidea","gigatexal",[429,425,41,395,430,38],"47605550","_pdp_",[432,425,38,252,11,41],"47605794",[434,425,38,252,101,38],"47605821",[163,436,33,305,164,38],18,[438,436,38,274,11,41],"47607170",[126,440,41,272,127,38],19,[442,440,38,294,11,41],"47606576",[444,445,45,335,446,38],"47609530",20,"DanDeBugger",[58,448,45,449,59,38],21,"project\u002Fpositive\u002Fprivacy",[228,448,38,263,11,41],[452,448,38,267,101,38],"47604655",[454,448,38,300,11,41],"47604793",[456,448,38,267,457,38],"47605570","TheTaytay",[459,448,38,252,101,38],"47605861",[461,448,38,252,457,38],"47609135",[463,448,38,267,101,38],"47609457",[465,448,38,252,457,38],"47661865",[467,448,33,468,469,38],"47606481","project\u002Fmixed\u002Fprivacy","gbibas",[471,448,38,252,314,38],"47607728",[473,448,38,252,469,38],"47609069",[475,448,38,252,314,38],"47613521",[55,477,38,335,11,41],22,[479,32,38,267,480,38],"47604512","zephyrwhimsy",[],[483,488,492,496,501,506],{"id":484,"name":485,"points":486,"category":487},"47593422","1-Bit Bonsai",430,"ai",{"id":489,"name":490,"points":491,"category":487},"47536761","nullclaw",340,{"id":493,"name":494,"points":495,"category":20},"47557921","Git bayesect",337,{"id":497,"name":498,"points":499,"category":500},"47580350","30u30.fyi",256,"other",{"id":502,"name":503,"points":504,"category":505},"47571183","korb",205,"consumer_social",{"id":507,"name":508,"points":509,"category":510},"47589856","pg_textsearch",203,"data",false,"v2",{"id":514,"name":5,"line":6,"ai":511,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":515,"top":18,"kw":516,"maker":11,"domain":10,"tier":19,"attempts":38,"strip":517,"url":9,"mix":518,"praise":95,"objection":118,"sub":21},47574871,-0.01,[24,25,26,27],"3030135333330511335313330153330133500300",[31,32,33,34],1794036697306]