Drop sandbox for Linux

kept by eddie sep 24

Drop is a rootless Linux sandbox that isolates coding agents and third‑party packages using user namespaces and optional gVisor while preserving the host work environment.

Weary of Data Brokers? California Site Offers One-Stop Opt Out for 500+ Services
California's DROP tool lets residents request deletion from over 500 data brokers in one go, but faces technical glitches and only works for state residents.
also on DROP
Homebrew: 6.0.0
Homebrew 6.0.0 ships tap-trust security, default internal JSON API, Linux sandboxing, bundle parallel installs, and deprecates Intel macOS for 2027.
also on Bubblewrap, #linux, #security, #developer-tools
Bubblewrap: A nimble way to prevent agents from accessing your .env files
Bubblewrap is a simple sandboxing tool that prevents AI coding agents from accessing sensitive .env files, offering a balance of security and flexibility.
also on Bubblewrap, #security, #ai-coding, #developer-tools
How we contain Claude across products
Anthropic details how it contains AI agent blast radius across three products using sandboxes, VMs, and human-in-the-loop controls, while documenting missed risks like pre-trust code execution and user-mediated prompt injection.
also on gVisor, #security, #developer-tools
A field guide to sandboxes for AI
Sandboxing tools for AI agents differ fundamentally by boundary (containers, gVisor, microVMs, Wasm), not just by policy, and picking the wrong one creates either leaks or excessive cost.
also on gVisor, #security, #developer-tools