Drop

Why it's ranked here

Agents and package installs now run arbitrary code on developer laptops, and most sandboxes make you rebuild your toolchain inside a container first. Drop takes the opposite bet: reuse the host's installed software, hide everything sensitive, and need no root. The code backs the claims. It refuses to start as root, discards every privilege before handing over control, and blocks the same sensitive system entries a standard container runtime does. Apache 2.0, written in Go, shipped as a single prebuilt binary for x86 and ARM.

What's good

The generated defaults are opinionated in useful ways. Shell startup files are exposed but never writable, because the host runs them and a writable copy would let sandboxed code plant commands outside. Package managers such as uv, pipx, cargo and Go can use host-installed tools while new installs land in a sandbox-only location. Published ports bind to localhost unless you ask otherwise, and the config comments warn plainly when an option like automatic port publishing exposes the machine. Non-terminal input and output are piped rather than handed over directly, so sandboxed code cannot rewrite them.

Tradeoffs

Terminal only: GUI apps, sound, setuid programs, Podman and Snap-installed software do not run inside. Isolated networking depends on the separate pasta package, and Ubuntu 24 and Fedora need extra AppArmor or SELinux setup. Read-only mounts that cover every nested mount need a kernel of at least 5.12. Outbound connection filtering exists only behind an in-progress feature flag, so by default a sandboxed program can still reach any remote host. Self-update is not built yet; the update command only checks.

How to use it well

Best for one developer running an AI coding agent or untrusted dependencies on a Linux workstation who wants containment without maintaining a container image. Run the generated base config past your own eyes first: the default list exposes files like your git config and cargo config, which can hold tokens. Switch network mode off for jobs that need no internet. Turn on the optional gVisor runtime when kernel exploits are in your threat model. It does not replace Docker for reproducible deployments or Flatpak for shipping desktop apps.

Observed

License

Apache 2.0 (LICENSE)

Language

Go (go.mod)

Interface

CLI with init, run, ls, rm, edit and update subcommands

Platform

Linux only, amd64 and arm64 prebuilt binaries

Install

Prebuilt binary download or build from source with make

Runtime dependency

pasta (passt package) for isolated networking; runsc for the optional gVisor runtime

Privileges

Refuses to run as root (cmd/drop/main.go)

Outbound firewall

Behind an in-progress feature flag (internal/config/firewall.go)

Configuration

TOML base file plus one file per environment