Reading up on Bubblewrap

Drop is a rootless Linux sandbox that isolates coding agents and third‑party packages using user namespaces and optional gVisor while preserving the host work environment.

Homebrew 6.0.0 ships tap-trust security, default internal JSON API, Linux sandboxing, bundle parallel installs, and deprecates Intel macOS for 2027.

Bubblewrap is a simple sandboxing tool that prevents AI coding agents from accessing sensitive .env files, offering a balance of security and flexibility.