Alternatives
Products that do what Buildcage does
Restrict outbound access in Docker builds on GitHub Actions
- 1EB
2017 · github.com
- 2
- 3
- 4BN
2020 · github.com
- 5CE
We just open-sourced CargoWall - a lightweight eBPF firewall for GitHub Actions. We originally built it to stop LLM agents from connecting to untrusted domains. After recent GitHub Actions supply chain compromises like the Trivy attack, we realized it'd work well for blocking untrusted connections from CI runners too. It uses iptables DNAT to redirect all outbound port 53 traffic to a local DNS proxy, which checks each query against a hostname allowlist before forwarding. Resolved IPs from allowed responses are inserted into eBPF LPM trie maps, and a TC egress classifier attached to the…
Mar 2026 · github.com
- 6CC
Hi HN - We've been working on Coasts (“containerized hosts”) to make it so you can run multiple localhost instances, and multiple docker-compose runtimes, across git worktrees on the same computer. Here’s a demo: https://www.youtube.com/watch?v=yRiySdGQZZA. There are also videos in our docs that give a good conceptual overview: https://coasts.dev/docs/learn-coasts-videos. Agents can make code changes in different worktrees in isolation, but it's hard for them to test their changes without multiple localhost runtimes that are isolated and scoped to those…
Mar 2026 · github.com
- 7AK
I'm a software engineer who keeps getting pulled into DevOps no matter how hard I try to escape it. I recently moved into a Lead DevOps Engineer role writing tooling to automate a lot of the pain away. On my own time outside of work, I built Artifact Keeper — a self-hosted artifact registry that supports 45+ package formats. Security scanning, SSO, replication, WASM plugins — it's all in the MIT-licensed release. No enterprise tier. No feature gates. No surprise invoices. Your package managers — pip, npm, docker, cargo, helm, go, all of them — talk directly to it using their native…
Feb 2026 · github.com
- 8
- 9NS
Hello! This is Edgar and Robbie and we built nix-snapshotter. nix-snapshotter brings native understanding of Nix packages to containerd. We built this because Nix is a great fit for making efficient containers. They don't need an OS because Nix captures all dependencies exactly. However, the current process of creating Nix images is subpar because one needs to transform Nix packages into a format that container runtimes understand. Using nix-snapshotter, instead of downloading image layers, packages come directly from the Nix store. Packages can be fetched from a binary cache or built on the…
2023 · github.com
- 10
- 11
- 12BB
This project addresses the inefficiencies of traditional Dockerfile-based container builds where each customization layer creates storage bloat through duplicate dependencies from repeated apt-get install commands, network inefficiency from redundant package downloads across different images, and slow iteration cycles requiring full rebuilds of all previous steps. Our solution enables building minimal base images from scratch using debootstrap that precisely include only required components in the initial build, while allowing creation of specialized variants (Java, Kafka, etc.) from these…
2025 · github.com
- 13BY
2024 · github.com
- 14SD
Most site blockers work by blacklisting distractions. That never worked for me, the internet is too big, and there’s always something new to waste time on. I wanted the opposite: allowlist‑only browsing. Block everything by default, and explicitly allow only what I need. So I built Sinkzone: a local DNS forwarder with two modes: Monitor mode: lets all traffic through, but logs every domain so you can decide what to allow. Focus mode: only allowlisted domains resolve; everything else is blocked (NXDOMAIN). It’s open source, written in Go, and runs locally on macOS, Linux, and Windows. Works a…
2025 · github.com
- 15AD
Hello HN! We just launched a new feature we built at Depot that accelerates Docker image builds on your local machine in a team environment, and we wanted to share some of the details with you all. The launch blog post: https://depot.dev/blog/local-builds Depot is a hosted container build service - we run fully managed Intel and Arm remote build machines in AWS, with large instance sizes and SSD cache disks. The machines run BuildKit, the build engine that powers Docker, so generally anything you can `docker build`, you can also `depot build`. Most people use Depot in CI,…
2023
- 16RL
I've been looking for a way to run LLMs safely without needing to approve every command. There are plenty of projects out there that run the agent in docker, but they don't always contain the dependencies that I need. Then it struck me. I already define project dependencies with mise. What if we could build a container on the fly for any project by reading the mise config? I've been using agent-en-place for a couple of weeks now, and it's working great! I'd love to hear what y'all think
Jan 2026 · github.com
- 17TY
2021 · github.com
- 18OS
Hey Hacker News! I am madnuttah, I am a Windows/Linux Sysadmin and some folks may remember this username for "niche" mods I've made for Fallout and Skyrim and some C# UWP Windows Store Apps which I've retired because of Microsoft's unclear strategy abandoning things from one day to another. Why am I writing this? I wanted to be independent from the DNS servers of my provider, because they have often shined brightly with problems in the past instead of functioning properly, wanted to have a little bit more privacy and freedom back by fighting censorship via DNS, so I built my own Unbound…
2022
- 19KC
We kept hitting the same wall: you clone some arbitrary repo and just want it to run without any configuration work. So we built Keystone, an open source tool that spins up a Modal sandbox, runs Claude Code inside it, and produces a working .devcontainer/ config (Dockerfile, devcontainer.json, test runner) for any git repo. We build on the dev container standard, so the output works with VS Code and GitHub Codespaces out of the box. Main use cases: reproducible dev/CI environments, self-describing repos, and safely sandboxed coding agents. Our goal is to encourage all repos to…
Feb 2026 · github.com
- 20OS
If you’ve ever worked with web scraping or automation using Puppeteer or Playwright, you know that running Chrome can be tricky. While headless mode (Chrome with no display) often works, some page elements only render in headed mode, forcing you to run Chrome with a display. This usually means bloating your Dockerfile with complex dependencies like xvfb. Updating your server or Lambda container to handle this can increase costs and lead to dependency hell. The Solution: I’ve built a streamlined solution—a Docker image that runs Chrome with all its necessary dependencies and exposes a FastAPI…
2024 · hub.docker.com
- 21IB
Hey everyone. It's Sherub here, author of the Build your own DNS Server challenge on CodeCrafters. Currently it’s available in Rust, Go, and Python and is free while in beta. https://codecrafters.io/dns-server I've kept the challenge accessible but still challenging for an intermediate developer. This challenge, like others from CodeCrafters, is self-paced. You can use any tools you prefer (terminal, editor, etc.) to build the project. At the end of the challenge, you will have created a DNS forwarding server. The server can create and read DNS packets and respond to DNS…
2023 · app.codecrafters.io
- 22
- 23SZ
We're launching SecureBuild: https://securebuild.com — a new way for open source projects and maintainers to earn revenue by partnering with and endorsing our Zero-CVE container images of their project. We’ve spent the last decade at Replicated (https://news.ycombinator.com/item?id=9841243) helping commercial and open source software vendors securely distribute their apps to enterprise environments. During that time, we saw firsthand how hard it is for maintainers to fund their work, and how increasingly demanding enterprises have become when it comes to demonstrable…
2025 · securebuild.com
- 24SM
Hi HN! I've posted this a few weeks back without much HN traction - today we've added a free community tier, so anyone can try it out. TL;DR: We’ve launched StableBuild, a new tool to easily freeze and pin Docker images, operating system packages, Python packages, and arbitrary build dependencies; in 5 lines of code: https://stablebuild.com . As the CTO at an ML startup w/ 75 people (https://edgeimpulse.com/) I’ve grown incredibly frustrated with non-deterministic builds. Last year basically every week one of our containers (we have 40+ unique ones in prod)…
2024 · stablebuild.com
Ranked by how close each launch is in meaning, then by votes. Refine with a description →