A Solo Coder's Linux Sandbox Hits 185 Points on Try Three

A rootless Linux sandbox called Drop reached 185 points and 62 comments on Hacker News on Sept. 22, four days after GitHub's trending page began showing it gaining stars. It was the tool's third submission to the site.

"Note: This is my 3rd submission of the project, the first two did not draw attention," developer Jan Wrobel wrote in the Show HN post. "Since then I have added support for gVisor and created a project website to better explain the concept and organize documentation." The repository, wrr/drop on GitHub, shows 233 stars, 8 forks and 5 open issues, and lists Wrobel as the sole listed owner. It was created July 25, 2025, more than a year before this week's front-page run.

What Drop actually isolates

Wrobel built Drop, he wrote, because he "always felt uneasy installing and running third-party programs" under his main account, where "a single compromised dependency means a full compromise of the system." The tool uses Linux namespaces (user, mount, network, PID, IPC and cgroup) to give each project its own disposable home directory, with select config files mounted read-only from the real one, and does not require root. An optional gVisor layer, documented on droprun.sh, runs sandboxed programs against a user-space kernel instead of issuing syscalls straight to the host, and Drop drops all Linux capabilities before a sandboxed program starts, so it cannot perform privileged operations like bind mounts even inside its own namespace.

The workflow, per the project site, mirrors Python's virtualenv: drop init sets up an environment, drop run enters it, and the isolation is enforced by the kernel rather than left to convention the way virtualenv's is. Drop is written in Go, requires a 1.25 or newer compiler to build, and ships prebuilt binaries for amd64 and arm64. It is Apache 2.0-licensed and Linux-only; the GitHub topics list includes llm-agents and security-tools alongside sandbox.

What the thread's top comment says it does not solve

The most-upvoted technical objection in the thread did not dispute that Drop works. It disputed what problem it solves. "Isolating against a compromised dependency needs filesystem and egress control," one commenter wrote. "Isolating against your own agent getting prompt-injected needs the credentials to never be inside the sandbox at all." A coding agent that is tricked by malicious text into misusing its own valid API keys is not stopped by a sandbox those keys are sitting inside, a distinction Drop's own documentation does not draw out for a user deciding whether it covers their actual threat.

Other commenters compared Drop's primitives to older, lower-level tools. "You are using the same fundamental primitives that are used in nsjail, runc, etc.," one wrote, and Wrobel agreed in the thread, saying he chose direct Linux API calls over a higher-level abstraction like runc for more flexibility. He also positioned Drop above bubblewrap, calling that project "low level" and "a sandbox building block" rather than something meant for daily use the way Drop is.

What Drop covers	What it does not
A compromised dependency reading or writing files outside its sandbox	Credentials the sandboxed process was already handed
Direct syscalls to the host kernel, when gVisor is enabled	Starting containers from inside the sandbox
Network access to services on localhost, blocked by default	Any use inside macOS, which the tool does not support

What is still missing

Drop cannot start containers from inside its own sandbox and does not run on macOS. GUI application support is on the roadmap but not shipped, and the project's issue tracker lists five open items as of Sept. 24. Wrobel did not say in the thread when a 1.0 release might ship, or whether the two failed earlier submissions changed which features he prioritized before this one. The same trend line of a small tool suddenly clearing the front page on a later attempt is one this site has tracked with Superpowers, where GitHub's own trending count, not a version bump, was what made the difference visible, and with Claude Code's own AGENTS.md rollout, where a fix rather than a new feature was what developers actually noticed.