Alternatives
Products that do what Z-Jail – A 130 KB Linux sandbox-C99 with 7 defense layers and zero deps does
- 1ZS
I'm excited to introduce Zerobox, a cross-platform, single binary process sandboxing CLI written in Rust. It uses the sandboxing crates from the OpenAI Codex repo and adds additional functionalities like secret injection, SDK, etc. Watch the demo: https://www.youtube.com/watch?v=wZiPm9BOPCg Zerobox follows the same sandboxing policy as Deno which is deny by default. The only operation that the command can run is reading files, all writes and network I/O are blocked by default. No VMs, no Docker, no remote servers. Want to block reads to /etc? zerobox…
Mar 2026 · github.com
- 2TV
Dec 2025 · github.com
- 3WA
Hi HN community, I’m Zach, founder and CEO of Warp, and am excited to show you Warp, a fast Rust-based terminal that’s easy to use and built for teams. As of today, Warp is in public beta and any Mac user can download it. It works with bash, zsh, and fish. The terminal’s teletype-like interface has made it hard for the CLI to thrive. After 20 years of programming, I still find it hard to copy a command’s output; I always forget how to use `tar`; and I always have to relearn how to move my cursor. To fix fundamental accessibility issues, I believe we need to start innovating on the terminal,…
2022 · warp.dev
- 4IW
Sep 2025 · github.com
- 5JA
2015 · github.com
- 6PO
2022 · github.com
- 7
Pangolin is an open source self-hosted tunneled reverse proxy management server with identity and access control, designed to securely expose private resources through encrypted WireGuard tunnels running in user space. We made Pangolin so you retain full control over your infrastructure while providing a user-friendly and feature-rich solution for managing proxies, authentication, and access, all with a clean and simple dashboard web UI. GitHub: https://github.com/fosrl/pangolin Deployment takes about 5 minutes on a VPS:…
2025 · github.com
- 8
A fast, rootless sandbox and virtual resource runtime for any workload, including untrusted and AI-generated code. Daemonless: a real, kernel-enforced container in ~3.5 ms from an OCI image, out of one static binary - getkern/kern
13d ago · github.com
- 9CA
2013 · coreos.com
- 10
- 11ZS
2019 · github.com
- 12
- 13
- 14GA
I built GRSH because I wanted a modern, memory-safe shell that feels native to FreeBSD but works seamlessly on macOS. While there are many shells out there, GRSH is my take on a minimal, fast, and secure command interpreter written entirely in Rust. It's designed for users who want the safety guarantees of Rust without the overhead of more bloated alternatives. I'm currently working on the official FreeBSD port. I’d love to get feedback on the shell's behavior and performance from the community. Github: https://github.com/antoniomalara301289/grsh
Jan 2026 · grimreaper.icu
- 15LT
hey guys. the other day i was migrating hosting providers and i just needed something not too heavy and convenient to spin up my backups for awhile and realised there is almost nothing out there. kimchi hasn't been updated for years and cockpit is heavy. so here's something i came up with in a couple hours because of a sudden urge, nothing fancy just basic creation with cloud init, lifecycle management and image/storage, but it's modern-ish and it compiles to a 8.4mb binary inclusive of the embedded web UI, CLI and API, and only dep is libvirt.
Sep 2025 · github.com
- 16
- 17GN
Hey HN! I just released go-nbd, a lightweight Go library for effortlessly creating NBD servers and clients. Its a neat tool for creating custom Linux block devices with arbitrary backends, such as a file, byte slice or what I'm planning to use it for, a tape drive. While there are a few partially abandoned projects like this out there already, this library tries to be as maintainable as possible by only implementing the most recent handshake revision and baseline functionality for both the client and the server, while still having enough support to be useful. I'd love to get your feedback :)
2023 · github.com
- 18ZS
Mar 2026 · github.com
- 19NA
Hi HN, I've been building Nucleus, a lightweight Linux container runtime focused on two workloads: ephemeral AI-agent sandboxes and declarative NixOS services. It's a single Rust binary, no daemon. It is not a Docker replacement and not a strict subset of Docker either. I dropped the entire image-and-distribution half (no Dockerfile, no layers, no registry, no pull/push, no persistent storage layer) in exchange for going deeper on isolation and reproducibility. The rootfs is either a directory copied into tmpfs (agent mode) or a Nix-built closure mounted read-only (production mode). If…
Jun 2026 · github.com
- 20FS
Hi HN! Fence wraps any command in a sandbox that blocks network by default and restricts filesystem writes. Useful for running semi-trusted code (package installs, build scripts, unfamiliar repos) with controlled side effects, or even just blocking tools that phone home. > fence curl https://example.com # -> blocked > fence -t code -- npm install # -> template with registries allowed > fence -m -- npm install # -> monitor mode: see what gets blocked One use-case is to use it with AI coding agents to reduce the risk of running agents with fewer interactive permission prompts: >…
Jan 2026 · github.com
- 21SS
2016 · github.com
- 22BA
bVisor is an SDK and runtime for safely executing bash commands directly on your host machine. We built it on the belief that "sandbox" doesn't need to mean shipping off to remote sandbox products, or spinning up local VMs / containers. Sometimes, you just want to run that bash command locally. bVisor boots a sandbox from user-space without special permissions, powered by seccomp user notifier. This allows us to intercept syscalls from guest processes and selectively virtualize them to block privilege escalation, isolate process visibility, and keep filesystem changes isolated per…
Feb 2026 · github.com
- 23
- 24
A single compiled binary that renders one curated status line for fish, bash and zsh, and binds the up arrow to its own history picker. The slowest module runs as a task via std.Io while the rest run alongside it, so a render costs about what its slowest probe costs.
Jul 2026 · yamafaktory.github.io
Ranked by how close each launch is in meaning, then by votes. Refine with a description →