Run a GitHub Actions step in a gVisor sandbox

In plain words

This tool allows developers to execute GitHub Actions workflow steps inside a gVisor sandbox, providing an isolated and secure runtime environment. It's designed for teams using GitHub Actions who need enhanced security through sandboxing. The main feature is the ability to run individual steps within gVisor's lightweight virtualization layer, reducing the risk of malicious code or dependencies affecting the host system or other workflow steps.

written from the facts on this page · September 2026

From the sources

- uses : geomys/[email protected] with : run : | go get -u -t ./... go test ./... Surprisingly enough, GitHub Actions with read-only permissions still receive a cache write token, allowing cache poisoning , so they are not safe to run untrusted code. This has led to supply chain compromises . Moreover, there is no isolation between steps in a workflow, since they all run on the same VM with root access. The only alternative is separating workflows with workflow_run , but that has its own limitations and overhead. This can lead to a false sense of security when running untrusted code in a workflow or step with read-only permissions (despite defaulting workflows to read-only permissions…from github.com

• 
  GitHub Actions2018 · github.com · ▲626

  Automate your workflow from idea to production

• 
  Execute any comment from issues and pull requests on GitHub2020 · github.com · ▲95

  Execute any script in a GitHub issue comment. Contribute to nwtgck/actions-comment-run development by creating an account on GitHub.

• 
  RuntimeMay 2026 · runtm.com · ▲303

  Sandboxed coding agents for everyone on your team

• 
  BuildJet for GitHub Actions2021 · buildjet.com · ▲82

  Managed high-performance runners for Github Actions

• 
  Use GitHub Actions to serve a serverless service2021 · github.com · ▲41

  Use GitHub Actions to create a Serverless service. - gitfx/ActionServerless

• MG
  Managed GitHub Actions Runners for AWS2024 · ▲117

  Hey HN! I'm Jacob, one of the founders of Depot (https://depot.dev), a build service for Docker images, and I'm excited to show what we’ve been working on for the past few months: run GitHub Actions jobs in AWS, orchestrated by Depot! Here's a video demo: https://www.youtube.com/watch?v=VX5Z-k1mGc8, and here’s our blog post: https://depot.dev/blog/depot-github-actions-runners. While GitHub Actions is one of the most prevalent CI providers, Actions is slow, for a few reasons: GitHub uses underpowered CPUs, network throughput for cache and the…

• 
  /dev/null▲481

  a social network for devs

  Dev tools · 2d ago · dev-null.sh

• 
  Whiteboard (YC W26) – an open-source IDE for thoughtful software design▲423

  open-source IDE for thoughtful software design. Contribute to devdotfast/whiteboard development by creating an account on GitHub.

  Dev tools · 27d ago · github.com

• 
  Reladraw – A diagram language where you decide where to place things▲411

  Contribute to reladraw/reladraw development by creating an account on GitHub.

  Dev tools · 25d ago · github.com

• 
  OpenBot▲362

  Grok Bot alternative: free, local, open-source, multiplayer

  Dev tools · 22d ago · openbot.run

• 
  Talanoa▲341

  Hi HN, I’m a fullstack developer, and honestly, I’ve lost count of how many side projects I’ve worked on over the years. But one idea kept coming back to me: a different kind of email client. It first came to me in 2014: “What if we could handle emails more like conversations?” Every year, I’d revisit this concept in my “Build Notes.” Ten years later, no one had built exactly what I had in mind — so I finally decided to do it myself. That’s how Talanoa was born. I wanted something focused on people, not timelines. I was tired of marking messages as unread just to remember to reply later, or…

  Dev tools · 20d ago · talanoa.email

• 
  CoreSpeed▲332

  One MCP for everything your agents need: apps, memory, tools

  Dev tools · 28d ago · corespeed.io

• 
  Cursor 2.0▲957

  Our first coding model and new interface for agents

  AI · Oct 2025 · cursor.com

• 
  Flask▲806

  Notion + Loom, for video collaboration.

  AI · 2025 · flask.do

• 
  Strange Attractors▲804

  I went down the rabbit hole on a side project and ended up building this: Strange Attractors(https://blog.shashanktomar.com/posts/strange-attractors). It’s built with three.js. Working on it reminded me of the little "maths for fun" exercises I used to do while learning programming in early days. Just trying things out, getting fascinated and geeky, and being surprised by the results. I spent way too much time on this, but it was extreme fun. My favorite part: someone pointed me to the Simone Attractor on Threads. It is a 2D attractor and I asked GPT to extrapolate it to…

  AI · Oct 2025 · blog.shashanktomar.com

• 
  Orchestra▲793

  A chat-centric workspace for builders and modern teams

  Work · 2025 · orch.so

• 
  Autism Simulator▲779

  Hey all, I built this. It’s not trying to capture every autistic experience (that’d be impossible). It’s based on my own lived experience as well as that of friends on the spectrum. I'm trying to give people a feel for what masking, decision fatigue, and burnout can look like day-to-day. That’s hard to explain in words, but easier to show through choices and stats. I'm not trying to "define autism". I’ve gotten good feedback here about resilience, meds, and difficulty tuning. I’ll keep tweaking it. If even a few people walk away thinking, "ah, maybe that’s why my coworker struggles in those…

  Life & fun · 2025 · autism-simulator.vercel.app

• 
  Director▲768

  Lovable for web automation

  AI · 2025 · director.ai