James Routley

Isolate programs and coding agents without leaving your familiar work environment

Use cases

Isolate coding agents
Run agents with --dangerously-skip-permissions and let Drop enforce permissions at the OS level. A hallucinated rm -rf ~ doesn’t touch your actual home dir. A prompt injection targeting ~/.ssh finds nothing. A connection to services running on localhost is rejected.
Isolate third-party programs
Install programs from PyPI, npm or any other source without giving them full access to your user account. If an installed program is malicious or compromised in a supply chain attack, the damage is contained within the sandbox.

Disposable, isolated environments
Inspired by Python’s virtualenv, Drop lets you create and enter easily disposable environments. Each environment has its own home directory while the original home is hidden.
Your existing distribution
Unlike Docker/Podman, Drop uses your existing distribution, so there is no container setup work: every program you’ve already installed is available in the sandbox.
Flexible config language
High-level TOML config lets you specify which files, dirs and local network services should be exposed to the sandbox. By default, all Drop environments share a base config, so you can configure Drop once and then create new environments without any configuration work.
Rootless
Drop doesn’t require root to run. It runs within a Linux user namespace, with its own process, mount, network, IPC and cgroup namespaces. Drop drops all the user namespace capabilities before executing a sandboxed program, so the program cannot do privileged operations within the user namespace, like bind mounts.
gVisor integration
As an option, Drop supports running programs on the gVisor user-space kernel. This is an additional isolation layer that prevents programs from accessing the host kernel directly, significantly reducing the potential to exploit kernel vulnerabilities.