5 ms·
Show HN: Zerobox – Sandbox any command with file, network, credential controls
I'm excited to introduce Zerobox, a cross-platform, single binary process sandboxing CLI written in Rust. It uses the sandboxing crates from the OpenAI Codex repo and adds additional functionalities like secret injection, SDK, etc.
Watch the demo: https://www.youtube.com/watch?v=wZiPm9BOPCg https://www.youtube.com/watch?v=wZiPm9BOPCg
Zerobox follows the same sandboxing policy as Deno which is deny by default. The only operation that the command can run is reading files, all writes and network I/O are blocked by default. No VMs, no Docker, no remote servers.
Want to block reads to /etc?
zerobox --deny-read=/etc -- cat /etc/passwd
cat: /etc/passwd: Operation not permitted
How it works:
Zerobox wraps any commands/programs, runs an MITM proxy and uses the native sandboxing solutions on each operating system (e.g BubbleWrap on Linux) to run the given process in a sandbox. The MITM proxy has two jobs: blocking network calls and injecting credentials at the network level.
Think of it this way, I want to inject "Bearer OPENAI_API_KEY" but I don't want my sandboxed command to know about it, Zerobox does that by replacing "OPENAI_API_KEY" with a placeholder, then replaces it when the actual outbound network call is made, see this example:
zerobox --secret OPENAI_API_KEY=$OPENAI_API_KEY --secret-host OPENAI_API_KEY=api.openai.com -- bun agent.ts
Zerobox is different than other sandboxing solutions in the sense that it would allow you to easily sandbox any commands locally and it works the same on all platforms. I've been exploring different sandboxing solutions, including Firecracker VMs locally, and this is the closest I was able to get when it comes to sandboxing commands locally.
The next thing I'm exploring is `zerobox claude` or `zerobox openclaw` which would wrap the entire agent and preload the correct policy profiles.
I'd love to hear your feedback, especially if you are running AI Agents (e.g. OpenClaw), MCPs, AI Tools locally.
- deleted 7mo ago[deleted]
- alyxya 7mo agoCool project, and I think there would be a lot of value in just logging all operations.
- kimixa 7mo agoFor just logging would it really give any more info than a trace already does?
- alyxya 7mo agoForgot about that, was mostly thinking about how AI agents with unrestricted permissions would ideally have some external logging and monitoring, so there would be a record of what it touched. A trace has all of the raw information, so some kind of wrapper around that would be useful.
- afshinmeh 7mo agoI'd like to know what level of details you'd expect. Something like `zerobox -- claude`, then you get an output log like this: ``` Read file /etc/passwd Made network call to httpbin.org Write file /tmp/access ``` etc.? I'm really interested to hear your thoughts and I will add that feature (I need something like that, too).
- kimixa 7mo ago*strace that is - annoyingly it seems it was autocorrected away
- afshinmeh 7mo agoI think there is still a valid case for sandbox logs/otel. strace would give you the syscalls/traces but not _why_ a particular call was blocked in side the sandbox (e.g. the decision making bit).
- afshinmeh 7mo agoAgreed. I added the `--debug` flag this morning. It does simple logging including the proxy calls: ``` $ zerobox --debug --allow-net=httpbin.org -- curl 2026-04-01T18:06:33.928486Z CONNECT blocked (client=127.0.0.1:59225, host=example.com, reason=not_allowed) curl: (56) CONNECT tunnel failed, response 403 ``` I'm planning on adding otel integration as well.
- eluded7 7mo agoPersonally I would probably always reach for a docker container if I want a sandboxed command that can run identically anywhere. I appreciate that alternate sandboxing tools can reduce some of the heavier parts of docker though (i.e. building or downloading the correct image) How would you compare this tool to say bubblewrap https://github.com/containers/ https://github.com/containers/
- ebb_earl_co 7mo agoThe text says that it uses OS-level tools, specifically bubble wrap on Linux.
- afshinmeh 7mo agoThat's right. It uses the same kernel mechanisms as Docker, the runtime is different though (bwrap on linux, seatbelt on mac, etc.)
- hrmtst93837 7mo ago[flagged]
- sebmellen 7mo agoYou are a bot. Botting HN is not allowed. Leave.
- hrmtst93837 7mo ago[flagged]
- time0ut 7mo agoVery interesting. I just started researching this topic yesterday to build something for adjacent use cases (sandboxing LLM authored programs). My initial prototype is using a wasm based sandbox, but I want something more robust and flexible. Some of my use cases are very latency sensitive. What sort of overhead are you seeing?
- afshinmeh 7mo agoI added a benchmark test (Apple M5) and on average I'm seeing 10ms overhead. I added a benchmark section to the repo as well https://github.com/afshinm/zerobox?tab=readme-ov-file#performance https://github.com/afshinm/zerobox?tab=readme-ov-file#perfor... Also, I'm literally wrapping Claude with zerobox now! No latency issues at all.
- qalfy 7mo agoWasm sandboxes are fast for pure compute but get painful the moment LLM code needs filesystem access or subprocess spawning. And it will, constantly. Containers with seccomp filters give you near-native speed and way broader syscall support — overhead is basically startup time (~2s cold, sub-second warm). For anything IO-heavy it's not even close. We're doing throwaway containers at https://cyqle.in https://cyqle.in if anyone's curious.
- afshinmeh 7mo agoI will run the same benchmark test on wasm sandboxes just to be able to compare it with Zerobox. I will share the results tomorrow.
- afshinmeh 7mo agoHere is the video, running Claude with Zerobox, you can see the latency, etc. https://www.youtube.com/watch?v=xzsGsSsx0OI https://www.youtube.com/watch?v=xzsGsSsx0OI
- jbverschoor 7mo agoAgain, it’s blacklisting so kind of impossible to get right. I’ve looked at this many times, but in order for things to properly work, you have to create a huge, huge, huge, huge sandbox file. Especially for your application that you any kind of Apple framework.
- simonw 7mo agoThis doesn't look like it's blacklisting to me. It's an allowlist system: --allow-net=api.openai.com # Explicitly allow access to that host --allow-write=config.txt # Explicitly allow write to that file
- afshinmeh 7mo agoThat's correct. The pattern is: reads allowed, write and network I/O blocked by default. ``` zerobox -- curl https://example.com https://example.com Could not resolve host: example.com ```
- simonw 7mo agoOh so it allows ALL file reads? I'd feel safer with default-deny on reads as well, but I know from past experience that this gets tricky fast - tools like Node.js and uv and Python all have a bunch of files they need to be able to read that you might not predict in advance. Might still be possible to do that in a DX-friendly way though, if you make it easy to manually approve reads the first time and use that to build a profile that can be reused on subsequent command invocations.
- afshinmeh 7mo agoI agree and you can deny all reads like this: ``` zerobox --deny-read=/ -- cat /etc/passwd ``` That being said, what the default DX shouldl be? What paths to deny by default? That's something I've been thinking about and I'd love to hear your thoughts.
- 7mo ago
- wepple 7mo agoYou should probably add a huge disclaimer that this is an untested, experimental project. Related, a direct comparison to other sandboxes and what you offer over those would be nice
- afshinmeh 7mo agoI agree to some extend. I'm using the OpenAI Codex crates for sandboxing though, which I think it's properly tested? They launched last year and iterated many times. I will add a note though, thanks!
- simonw 7mo agoThis looks really good - the CLI interface design is solid, and I especially like the secrets / network proxy pattern - but the thing it needs most is copiously detailed documentation about exactly how the sandbox mechanism works - and how it was tested. There are dozens of projects like this emerging right now. They all share the same challenge: establishing credibility. I'm loathe to spend time evaluating them unless I've seen robust evidence that the architecture is well thought through and the tool has been extensively tested already. My ideal sandbox is one that's been used by hundreds of people in a high-stakes environment already. That's a tall order, but if I'm going to spend time evaluating one the next best thing is documentation that teaches me something about sandboxing and demonstrates to me how competent and thorough the process of building this one has been. UPDATE: On further inspection there's a lot that I like about this one. The CLI design is neat, it builds on a strong underlying library (the OpenAI Codex implementation) and the features it does add - mainly the network proxy being able to modify headers to inject secrets - are genuinely great ideas.
- afshinmeh 7mo agoSimon! Thanks. I appreciate your comment and totally agreed. I will improve the docs as well as tests.
- kjok 7mo ago> There are dozens of projects like this emerging right now. They all share the same challenge: establishing credibility. Care to elaborate on the kind of "credibility" to be established here? All these bazillion sandboxing tools use the same underlying frameworks for isolation (e.g., ebpf, landlock, VMs, cgroups, namespaces) that are already credible.
- simonw 7mo agoThe problem is that those underlying frameworks can very easily be misconfigured. I need to know that the higher level sandboxing tools were written by people with a deep understanding of the primitives that they are building on, and a very robust approach to testing that their assumptions hold and they don't have any bugs in their layer that affect the security of the overall system. Most people are building on top of Apple's sandbox-exec which is itself almost entirely undocumented!
- zephyrwhimsy 7mo ago[flagged]
- volume_tech 7mo ago[flagged]
- afshinmeh 7mo agoThanks and agreed! Zerobox uses the Deno sandboxing policy and also the same pattern for cred injection (placeholders as env vars, replaced at network call time). Real secrets are never readable by any processes inside the sandbox: ``` zerobox -- echo $OPENAI_API_KEY ZEROBOX_SECRET_a1b2c3d4e5... ```
- simonw 7mo agoDo you know if there's a widely shared name for this pattern? I've been collecting examples of it recently - it's a really good idea - but I'm not sure if there's good terminology. "Credential injection" is one option I've seen floating around.
- afshinmeh 7mo agoNot sure. I took this idea from the Deno sandboxing docs. They also do the exact same thing, different sandboxing mechanism though (I think Deno has it's own way of sandboxing subprocesses).
- TheTaytay 7mo agosimonw, I have been seeing "credential injection" and "credential tokenizing" (a la tokenizer: https://github.com/superfly/tokenizer https://github.com/superfly/tokenizer). I'm also seeing credential "surrogates" mentioned. I am currently working on a mitm proxy for use with devcontainers to try to implement this pattern, but I'm certainly not the only one!
- simonw 7mo agoThanks, I think I'll go with "credential injection" since the word "tokenization" has other meanings that I find confusing here.
- mdavid626 7mo agoI trust sandbox-exec more, or Docker on Linux. Those come from the OS, well tested and known. MITM proxy is nice idea to avoid leaking secrets. Isn’t it very brittle though? Anthropic changes some URL-s and it’ll break.
- afshinmeh 7mo agoThanks for sharing that. Zerobox _does_ use the native OS sandboxing mechanisms (e.g. seatbelt) under the hood. I'm not trying to reinvent the wheel when it comes to sandboxing. Re the URLs, I agree, that's why I added wildcard support, e.g. `*.openai.com` for secret injection as well as network call filtering.
- mdavid626 7mo agoHow do you intercept network traffic on mac os? How do you fake certificates?
- afshinmeh 7mo agoZerobox creates a cert in `~/.zerobox/cert` on the first proxy run and reuses that. The MTIM process uses that cert to make the calls, inject certs, etc. This is actually done by the underlying Codex crate.
- mdavid626 7mo agoYeah, but how does the sandboxed process “know” that it has to go through the proxy? How does it trust your certificate? Is the proxy fully transparent?
- afshinmeh 7mo agoOh I see. It inject HTTP_PROXY/HTTPS_PROXY/etc. env vars into the process so that all sandboxed subprocesses go through the proxy.
- nonameiguess 7mo agoThis is more a criticism of codex's linux-sandboxing, which you're just wrapping, but it's the first I've ever looked at it. I don't see how it makes sense to invoke bwrap as a forked subprocess. Bubblewrap can't do anything beyond what you can do with unshare directly, which you can simply invoke as a system call without needing to spawn a subprocess or requiring the user to have bwrap installed. It kinds of reeks of amateur hour when developers effectively just translate shell scripts into compiled languages by using whatever variant of "system" is available to make the same command invocations you would make through a shell, as opposed to actually using the system call API. Especially when the invocation is crafted from user input, there's a long history of exploits arising from stuff like this. Writing it in Rust does nothing for you when you're just using Rust to call a different CLI tool that isn't written in Rust.
- afshinmeh 7mo agoThanks for sharing this, I read your comment multiple times. What would be the alternative though? It is true that the program being written in Rust doesn't solve the problem of spawning subprocesses, but what's the alternative in that case?
- simonw 7mo agoIs your criticism here that there's no point in invoking bwrap directly when you could instead implement the same things that bwrap implements? I'd much rather a system call bwrap than re-implement bwrap, because bwrap has already been extensively tested.
- afshinmeh 7mo agoThat was my thinking, too. The only other option would be reimplement it in Rust (never researched what exists though).
- gigatexal 7mo agothere's been so many of these -- which of these sandboxing tools is best?
- _pdp_ 7mo agoNot a single one. All of them are solving the obvious (and wrong) problem.
- MarcelinoGMX3C 7mo ago[dead]
- EGreg 7mo agoThis is really useful! How well does it compare though to Docker etc. Because I am worried about sandbox escapes. This is what we currently use to sandbox JS inside Browsers and Node (without anything extra) : https://github.com/Qbix/Platform/blob/main/platform/plugins/Q/web/js/methods/Q/Sandbox/run.js https://github.com/Qbix/Platform/blob/main/platform/plugins/... I like tools like this, but they all seem to share the same underlying shape: take an arbitrary process and try to restrict it with OS primitives + some policy layer (flags, proxies, etc). That works, but it also means correctness depends heavily on configuration, i.e. you’re starting with a lot of ambient authority and trying to subtract from it enforcement ends up split across multiple layers (kernel, wrapper, proxy) An alternative model is to flip it: Instead of sandboxing arbitrary programs, run workflows in an environment where there is no general network/filesystem access at all, and every external interaction has to go through explicit capabilities. In that setup, there’s nothing to "block" because the dangerous primitives aren’t exposed, execution can be deterministic/replayable, so you can actually audit behavior. Thus, secrets don’t enter the execution context, they’re only used at the boundary It feels closer to capability-based systems than traditional sandboxing. Curious how people here think about that tradeoff vs OS-level sandbox + proxy approaches.
- afshinmeh 7mo agoZerobox uses the same kernel mechanisms (namespaces + seccomp) but no daemon, no root and cold start ~10ms (Docker is much worse in that regard). Docker gives you full filesystem isolation and resource limits. Zerobox gives you granular file/network/credential controls with near zero overhead. You can in fact use Zerobox _inside_ Docker (e.g. for secret management)
- docybo 7mo ago[dead]
- _enjn 7mo ago[dead]
- _enjn 7mo ago[dead]
- smallerfish 7mo agoCompare with and steal any ideas you like from mine if you like. I've got a semi-decent curl|bash pattern covered, and also add network filtering via pasta (which may be more robust than rolling your own). https://github.com/reubenfirmin/bubblewrap-tui https://github.com/reubenfirmin/bubblewrap-tui
- afshinmeh 7mo agoOhh! thanks for sharing this. You are using DNS proxy which is interesting and useful if a process doesn't respect the HTTPS_PROXY/HTTP_PROXY/etc. env vars that I'm injecting. I will take a look, very interesting.
- dk8996 7mo agoVery cool. Is there a way to have a notion of a session, saving state between runs?
- afshinmeh 7mo agoNo, it's stateless right now. What is your requirement though? How do you define a session? Are you referring to "snapshotting" between sessions?
- afshinmeh 7mo agoI'm adding snapshotting as well https://github.com/afshinm/zerobox/pull/21 https://github.com/afshinm/zerobox/pull/21 Then you can run: ``` zerobox --snapshot -- sh -c 'echo "abc" > a' ``` and also `zerobox snapshot list/diff/restore`
- jwilliams 7mo agoIt’s terrific to see this. I’m definitely going to give it a whirl. I’ve been working on a specific JavaScript isolate[^1]. This is great source of inspiration for it. [^1]: https://github.com/jonathannen/hermit https://github.com/jonathannen/hermit
- afshinmeh 7mo agoI'd love to hear your thoughts! I've been primarily testing this with Bun + Vercel AI SDK for tool call sandboxing.
- Lethalman 7mo agoWish it wasn’t rust… it’s so hard to read.
- afshinmeh 7mo agoI know. I will add more docs soon though, that should make it easier to navigate the code and understand what's going on.
- lights0123 7mo ago> zerobox --secret OPENAI_API_KEY=$OPENAI_API_KEY Linux by default allows all users to read CLI arguments of running processes. While it looks like your bwrap invocation prevents the sandbox from looking at this process (--unshare-pid), any other process running on your system can read the secret.
- afshinmeh 7mo agoThat's true and the expected behaviour but I see your point. The example there is not great, I should've used `sk_s123...` to show that you are passing the env var to the sandbox as opposed to setting it on the host, then proxying it. I will update it.
- mina_jamshidian 7mo agoDoes Zerobox support audit logging for blocked network or file operations?
- afshinmeh 7mo agoI added some basic --debug support earlier today, but I will work on proper JSONL/Otel integration soon.
- rao-v 7mo agoHey - I'd love for you to add a documented / standard way to use this inside dockers so we can use build on it for various agentic efforts. I've solved getting bubblewrap to work inside a docker once for the nanobot project, but the folks there are dragging their feet on incorporating sandboxing. https://github.com/HKUDS/nanobot/pull/1940 https://github.com/HKUDS/nanobot/pull/1940
- afshinmeh 7mo agoI've been testing this on Docker today, including the credential injection, env vars, net calls control. I will add more docs but one interesting use case would be to have something like `zerobox --profile nanoclaw -- nanoclaw`, or something similar. I'd like to hear your thoughts.
- rao-v 7mo agoI'll give it a shot later today, but basically you need a pretty specific seccomp profile (see my example - I pulled from the podman repo) to allow bubblewrap to run inside an unpriviledged docker.
- DanDeBugger 7mo agoI love sandboxes man
- Mooshux 7mo ago[dead]
- Gerharddc 7mo agoOh wow, this looks nicely done! It's also nice that it's cross platform. I've done something similar with https://github.com/Gerharddc/litterbox https://github.com/Gerharddc/litterbox which takes things a bit further by allowing you to easily sandbox your entire development environment (i.e. IDE and everything) using containers. Unfortunately I have not gotten around to the network sandboxing part though, that seems very tricky to get useful without being too "annoying".
- afshinmeh 7mo agoThanks for sharing this. I really like the idea
- nwlsrb 7mo agoCool project! I think there would be a lot of value in just having a mode that logs all the file operations a script tries to make. Great work!
- deleted 7mo ago[deleted]
- kvikuz 6mo ago[dead]
- kvikuz 6mo ago[dead]
- kvikuz 6mo agoWe've seen cases where filesystem sandboxing alone wasn't enough — outbound requests still allowed credential exfiltration attempts.