Alternatives
Products that do what Deno Sandbox does
The safest, simplest way to run untrusted code.
- 1ZS
I'm excited to introduce Zerobox, a cross-platform, single binary process sandboxing CLI written in Rust. It uses the sandboxing crates from the OpenAI Codex repo and adds additional functionalities like secret injection, SDK, etc. Watch the demo: https://www.youtube.com/watch?v=wZiPm9BOPCg Zerobox follows the same sandboxing policy as Deno which is deny by default. The only operation that the command can run is reading files, all writes and network I/O are blocked by default. No VMs, no Docker, no remote servers. Want to block reads to /etc? zerobox…
Mar 2026 · github.com
- 2SA
2020 · github.com
- 3HU
2020 · github.com
- 4SU
Hi everyone, I built a runtime to isolate untrusted code using wasm sandboxes. Basically, it protects your host system from problems that untrusted code can cause. We’ve had a great discussion about sandboxing in Python lately that elaborates a bit more on the problem [1]. In TypeScript, wasm integration is even more natural thanks to the close proximity between both ecosystems. The core is built in Rust. On top of that, I use WASI 0.2 via wasmtime and the component model, along with custom SDKs that keep things as idiomatic as possible. For example, in Python we have a simple decorator:…
Feb 2026 · github.com
- 5LF
Shuru is a lightweight sandbox that spins up Linux VMs on macOS using Apple's Virtualization.framework. Boots in about a second on Apple Silicon, and everything is ephemeral by default. There's a checkpoint system for when you do want to persist state, and sandboxes run without network access unless you explicitly allow it. Single Rust binary, no dependencies. Built it for sandboxing AI agent code execution, but it works well for anything where you need a disposable Linux environment.
Feb 2026 · shuru.run
- 6
- 7SM
I wanted to see how fast an isolated code sandbox could start if I never had to boot a fresh VM. So instead of launching a new microVM per execution, I boot Firecracker once with Python and numpy already loaded, then snapshot the full VM state. Every execution after that creates a new KVM VM backed by a `MAP_PRIVATE` mapping of the snapshot memory, so Linux gives me copy-on-write pages automatically. That means each sandbox starts from an already-running Python process inside a real VM, runs the code, and exits. These are real KVM VMs, not containers: separate guest kernel, separate guest…
Mar 2026 · github.com
- 8EY
Hey all, Andy from the Deno team here. We're excited to share with you Deno Subhosting, an easy way to extend your platforms functionality by securely running untrusted JavaScript written by your users. When we first launched Deno Deploy in 2021, we were surprised at the volume of requests from companies about getting access to the APIs needed to run Deno Deploy. Many companies wanted to give their users the ability to write custom logic in their app, but setting this up in the cloud presents security concerns and a ton of infra work/maintenance. We realized that there was an…
2023 · deno.com
- 9AP
2020 · github.com
- 10GG
2020 · github.com
- 11TV
Dec 2025 · github.com
- 12IB
2025 · github.com
- 13GB
I built this because I was always creating machines on GH actions to test builds on different OS, and I wanted a tight CLI that could do it. I always saw Actions as this great resources and ephemeral machines you could do dev work in just were a natural way for me to work, so this grew out of that workflow. I didn't expect it to blow up, so it wasn't 100% finished when I posted it. But it should stabilize pretty quickly. Happy to know what you think and talk about it.
May 2026 · ghost.charity
- 14EJ
This TypeScript package allows you to safely execute JavaScript code within a WebAssembly sandbox using the QuickJS engine. Perfect for isolating and running untrusted code securely, it leverages the lightweight and fast QuickJS engine compiled to WebAssembly, providing a robust environment for code execution. Features - *Security*: Run untrusted JavaScript code in a safe, isolated environment. - *File System*: Can mount a virtual file system - *Custom Node Modules*: Custom node modules are mountable - *Fetch Client*: Can provide a fetch client to make http(s) calls - *Test-Runner*: Includes…
2024 · github.com
- 15DS
2024 · github.com
- 16
- 17RS
Hi HN, I’m Kyle and together with Andrew (https://news.ycombinator.com/user?id=stanleydrew) we’ve been working on Riza (https://riza.io), a project to make WASM sandboxing more approachable. We’re excited to share a developer preview of our code interpreter API with HN. There’s a bit of a backstory here. A few months ago, an old coworker reached out asking how to execute untrusted code generated by an LLM. Based on our experience building a plugin system for sqlc (https://sqlc.dev), we thought a sandboxed WASM runtime would be a good fit. A bit of hacking…
2024 · riza.io
- 18
- 19RO
Finally open sourced an internal tool we've been using for managing secrets. It's similar to SOPS, but more opinionated, easier to configure/use correctly, and produces nicer git diffs. It also supports one-way encryption, so you don't have to know the private key to add secrets.
2023 · github.com
- 20
- 21SN
This past quarter has been awash with sophisticated npm supply chain attacks like [Shai-Hulud](https://www.cisa.gov/news-events/alerts/2025/09/23/widesprea...() and the [Chalk/debug Compromise](https://www.wiz.io/blog/widespread-npm-supply-chain-attack-b...). This CLI helps protect users from recently compromised packages by only downloading packages that have been public for a while (default is 90 days or older). Install: npm install -g @dendronhq/safe-npm Usage: safe-npm install react@^18 lodash How it works: - Queries…
Nov 2025 · github.com
- 22
- 23
A fast, rootless sandbox and virtual resource runtime for any workload, including untrusted and AI-generated code. Daemonless: a real, kernel-enforced container in ~3.5 ms from an OCI image, out of one static binary - getkern/kern
13d ago · github.com
- 24NA
Hi HN, I've been building Nucleus, a lightweight Linux container runtime focused on two workloads: ephemeral AI-agent sandboxes and declarative NixOS services. It's a single Rust binary, no daemon. It is not a Docker replacement and not a strict subset of Docker either. I dropped the entire image-and-distribution half (no Dockerfile, no layers, no registry, no pull/push, no persistent storage layer) in exchange for going deeper on isolation and reproducibility. The rootfs is either a directory copied into tmpfs (agent mode) or a Nix-built closure mounted read-only (production mode). If…
Jun 2026 · github.com
Ranked by how close each launch is in meaning, then by votes. Refine with a description →