Alternatives
Products that do what Minimal container-like sandbox built from scratch in C does
Runbox recreates core container features without relying on existing runtimes or external libraries. It uses namespaces, cgroups v2, and seccomp to create an isolated process environment, with a simple shell for interaction. For future gonna work on adding an interface so external applications can be executed inside Runbox, similar to containers. Github: https://github.com/Sahilb315/runbox Happy to hear feedback or suggestions.
- 1
- 2RC
Hi HN, this is Cesar and Rodny, developers of an open-source container runtime called Sysbox, and co-founders of a startup called Nestybox (YC S20). We launched on HN almost a year ago and got excellent feedback then (https://news.ycombinator.com/item?id=24084758). Happy to say that over the past year, Sysbox has continued to gain traction, particularly for securing containers in production, CI/CD, and containerized dev environments. We wanted to announce an important new feature: integration between Sysbox and Kubernetes. As a quick refresher, Sysbox is a "runc" that…
2021
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11VQ
2020 · github.com
- 12
Local sandboxes for AI agents on your Mac, Linux, bare metal
Aug 2026 · github.com
- 13
- 14
- 15PB
2018 · github.com
- 16LV
Hello HN! We've been working on a new hypervisor https://kwarantine.xyz that can run strongly isolated containers. This is still a WIP, but we wanted to give the community an idea about our approach, its benefits, and various use cases it unlocks. Today, VMs are used to host containers, and make up for the lack of strong security as well as kernel isolation in containers. This work adds this missing security piece in containers. We plan on launching a free private beta soon. Meanwhile, we'd deeply appreciate any feedback, and happy to answer any questions here or on our slack…
2021
- 17BM
Wrapper around Apple's macOS sandbox-exec tool, which usually sandboxes native apps. It is "allow-first" i.e. it will not overprotect everything, just crucial information and therefore allows most tools to run without issues. Limiting is done using a .gitignore like file schema. Further TOML config options available. I built it because Docker sandboxing requires config and planning. Build in sandboxing of AI tools instead is limited to the very tools themselves, instead I wanted to have a simple cage around Claude running inside VSCode. Also needed to protect files inside a folder like…
Apr 2026 · github.com
- 18DO
2015 · zwischenzugs.wordpress.com
- 19SB
Hi HN, We are building Sanbox, a platform for running AI agents in isolated and resumable sandboxes. We use the OpenCode SDK as the harness, support reusable templates, and have a CLI that works with Codex, Claude Code, Cursor, CI, or your terminal. Each sandbox has MicroVM isolation, a persistent filesystem, and live trail of run events. Can also self-host if required for security/compliance. It's on the roadmap to add network ACL, secrets managements, LLM cost tracking & observability. We are also happy to build custom integrations or triggers for specific use cases. For example,…
Jul 2026 · sanbox.cloud
- 20RS
Hey HN, Rove is a deployment tool that I've been working on for a short while. I was motivated to create this after building a CD SaaS for AWS, and becoming disillusioned with the unnecessary complexity and costs associated with running containers in proprietary "cloud" runtimes. Rove is very different from that. It is a single binary, does not communicate with an external service, and deployments run in a single command. Deployments are diffed so you can see changes before applying them, sort of like Terraform. There is no proprietary runtime because everything just runs on Docker Swarm…
2024 · rove.dev
- 21RA
Hello HN! Just wanted to share a small project I've been working for the last few months. It's a tool called Runal, a text-based creative coding environment that runs in the terminal. It works similarly as processing or p5js but it does all the rendering as text. And it can either be scripted with JavaScript or used as a Go package. It's open-source and cross-platform (linux, macOS, windows). It seems to me that text/ascii-art aesthetics are really popular in creative coding communities, so I though it would make sense to create a tool that runs on a platform which can render text only.…
2025 · github.com
- 22AD
I'd like to share a project I've been working on for the past few months. It's a distributed workflow engine written entirely in Go. Some highlights: * Tasks are executed in a Docker container * Can run stand-alone or distributed * Highly extensible * Able to enforce limits (CPU/RAM) per task * Web UI Would love the get your feedback on it, and find out if this could be useful.
2023 · github.com
- 23SA
Hi HN, This is a project I've been working on since the beginning of 2025 full time, without funding. Coding agents have fundamentally changed the way we write software. When you let an agent write code, pull dependencies, and run scripts, you are delegating trust while still keeping the responsibility. You shouldn't have to choose between moving fast with agents and maintaining basic control over your host machine. Normally, we just inspect the final result, treating the app like a black box. Most security tools only sandbox the app runtime and ignore the build phase. CapaKit is my attempt…
Jun 2026 · capakit.com
- 24RS
Built a native Scratch 3.0 runtime in Lua that runs .sb3 projects without a browser. Why? Browser sandboxing prevents access to hardware features (haptics, sensors, fine-grained perf controls). Native runtime gives you direct hardware access and lets you deploy to consoles, handhelds, embedded devices. Also means much smaller binaries (LÖVE is ~7MB vs 50-100MB for Electron). How it works: - Scratch blocks compile to IR, then optimize, then generate Lua - LuaJIT executes the compiled code - Coroutine-based threading for concurrent scripts - Lazy loading + LRU cache for memory management - SVG…
Oct 2025 · github.com
Ranked by how close each launch is in meaning, then by votes. Refine with a description →