Drop: A Rootless Linux Sandbox with gVisor Support for Program and Agent Isolation

Introduction to Drop Sandbox

Drop is a new Linux sandboxing solution designed to isolate programs and coding agents. It operates without requiring root privileges, utilizing Linux user namespaces to create isolated environments. This approach allows users to run untrusted code or third-party applications with reduced risk to their main system.

Isolation Capabilities

Drop enforces permissions at the operating system level, preventing sandboxed programs from accessing sensitive user directories like the home directory or SSH keys. It also rejects connections to services running on localhost by default. This containment strategy aims to limit the impact of malicious programs or supply chain compromises.

Disposable Environments and Configuration

Inspired by Python's virtualenv, Drop enables the creation of disposable, isolated environments, each with its own home directory. Unlike containerization tools such as Docker, Drop integrates with the user's existing Linux distribution, making all installed programs available within the sandbox. Configuration is managed through a high-level TOML language, allowing users to specify which files, directories, and local network services are exposed to the sandbox.

Rootless Operation and gVisor Integration

Drop runs within a Linux user namespace and does not require root access. It drops user namespace capabilities before executing sandboxed programs, preventing privileged operations within the user namespace. For enhanced isolation, Drop offers optional integration with gVisor, a user-space kernel that prevents programs from directly accessing the host kernel, thereby reducing the risk of kernel vulnerability exploitation.