afshinm

zerobox

Rust2026–2026

afshinm / zerobox

zerobox

Lightweight, cross-platform process sandboxing powered by OpenAI Codex's runtime. Sandbox any command with file, network, and credential controls.

Explore on GitHub Read Hacker News discussions

2Distinct people

6Mentions

0Explicit recommenders

730GitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

Lightweight, cross-platform process sandboxing powered by OpenAI Codex's runtime. Sandbox any command with file, network, and credential controls.

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by week6 dated mentions

Observed mentions: 2026-03-30 14:32:36 UTC to 2026-06-07 13:30:49 UTC. Weeks start Monday, UTC.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Submissions	Comments
Mar 30	2026-03-30 00:00:00 UTC	2026-04-06 00:00:00 UTC	3	1	2
Apr 6	2026-04-06 00:00:00 UTC	2026-04-13 00:00:00 UTC	0	0	0
Apr 13	2026-04-13 00:00:00 UTC	2026-04-20 00:00:00 UTC	0	0	0
Apr 20	2026-04-20 00:00:00 UTC	2026-04-27 00:00:00 UTC	0	0	0
Apr 27	2026-04-27 00:00:00 UTC	2026-05-04 00:00:00 UTC	1	0	1
May 4	2026-05-04 00:00:00 UTC	2026-05-11 00:00:00 UTC	1	0	1
May 11	2026-05-11 00:00:00 UTC	2026-05-18 00:00:00 UTC	0	0	0
May 18	2026-05-18 00:00:00 UTC	2026-05-25 00:00:00 UTC	0	0	0
May 25	2026-05-25 00:00:00 UTC	2026-06-01 00:00:00 UTC	0	0	0
Jun 1	2026-06-01 00:00:00 UTC	2026-06-08 00:00:00 UTC	1	0	1

What Hacker News says

6 sources

mathstuf·Jun 7, 2026

There are a number of utilities for this. I use jai: https://jai.scs.stanford.edu/ but also have seen nono: https://github.com/always-further/nono smolvm: https://github.com/smol-machines/smolvm zerobox https://github.com/afshinm/zerobox and matchlock https://github.com/jingkaihe/matchlock They all have pros and cons. Pick the one that suits you best. Then you're also agent harness flexible (I use opencode).

In Anthropic, please ship an official Claude Desktop for Linux

afshinmeh·May 6, 2026

That's exactly how I tried to address that problem with https://github.com/afshinm/zerobox -- you control what network access (e.g. `--deny-net *.amazonaws.com`) your agent has and you also get snapshotting out of the box. That said, using LakeFS is probably a better long term solution and I like this approach.

In Show HN: Tilde.run – Agent sandbox with a transactional, versioned filesystem

afshinmeh·May 3, 2026

Agreed and it's a pattern that OpenAI suggested a few days ago, too [1]. I also built a cross platform process level sandboxing that uses parts of OpenAI Codex for the same purpose [2] [1] https://openai.com/index/the-next-evolution-of-the-agents-sd... [2] https://github.com/afshinm/zerobox

In The agent harness belongs outside the sandbox

afshinmeh·Apr 3, 2026

I'm adding snapshotting as well https://github.com/afshinm/zerobox/pull/21 Then you can run: ``` zerobox --snapshot -- sh -c 'echo "abc" > a' ``` and also `zerobox snapshot list/diff/restore`

In Show HN: Zerobox – Sandbox any command with file, network, credential controls

afshinmeh·Apr 1, 2026

I added a benchmark test (Apple M5) and on average I'm seeing 10ms overhead. I added a benchmark section to the repo as well https://github.com/afshinm/zerobox?tab=readme-ov-file#perfor... Also, I'm literally wrapping Claude with zerobox now! No latency issues at all.

In Show HN: Zerobox – Sandbox any command with file, network, credential controls

afshinmeh·Mar 30, 2026Submission

Show HN: Zerobox – Sandbox any command with file, network, credential controls

I'm excited to introduce Zerobox, a cross-platform, single binary process sandboxing CLI written in Rust. It uses the sandboxing crates from the OpenAI Codex repo and adds additional functionalities like secret injection, SDK, etc. Watch the demo: https://www.youtube.com/watch?v=wZiPm9BOPCg Zerobox follows the same sandboxing policy as Deno which is deny by default. The only operation that the command can run is reading files, all writes and network I/O are blocked by default. No VMs, no Docker, no remote servers. Want to block reads to /etc? zerobox --deny-read=/etc -- cat /etc/passwd cat: /etc/passwd: Operation not permitted How it works: Zerobox wraps any commands/programs, runs an MITM proxy and uses the native sandboxing solutions on each operating system (e.g BubbleWrap on Linux) to run the given process in a sandbox. The MITM

Read the rest

proxy has two jobs: blocking network calls and injecting credentials at the network level. Think of it this way, I want to inject "Bearer OPENAI_API_KEY" but I don't want my sandboxed command to know about it, Zerobox does that by replacing "OPENAI_API_KEY" with a placeholder, then replaces it when the actual outbound network call is made, see this example: zerobox --secret OPENAI_API_KEY=$OPENAI_API_KEY --secret-host OPENAI_API_KEY=api.openai.com -- bun agent.ts Zerobox is different than other sandboxing solutions in the sense that it would allow you to easily sandbox any commands locally and it works the same on all platforms. I've been exploring different sandboxing solutions, including Firecracker VMs locally, and this is the closest I was able to get when it comes to sandboxing commands locally. The next thing I'm exploring is `zerobox claude` or `zerobox openclaw` which would wrap the entire agent and preload the correct policy profiles. I'd love to hear your feedback, especially if you are running AI Agents (e.g. OpenClaw), MCPs, AI Tools locally.

141 points · Open discussion