| yoloAI does something similar: - Sandbox on Linux using Docker, Podman, containerd, gVisor, Kata, Firecracker - Sandbox on Mac using Docker (Docker Desktop or Orbstack), Podman, Apple containers, Seatbelt, Tart (Tart lets you run simulators). - Network restriction - Secrets control (file mounts or credentials broker) - NO ambient data (ENV is replaced with a minimal and local-to-sandbox one, no host-side filesystem access beyond what you explicitly allow) - Workdir protection: Your work dir is never modified until you apply the changes, either standalone or as a git commit. You can also diff before applying. Git runs SANDBOX side in case the repo has filters. - Uses copy-on-write if your filesystem supports it (most modern ones do) - Has built-in support for claude, codex, gemini, aider, and opencode, but you can also launch it in "shell" mode and run whatever you want. - Supports VS code tunnels, so you can remotely access in VS code if you don't want to use the terminal. - Full lifecycle support: Launch, attach, stop, restart, wait, one-shot, clone, destroy - MCP passthrough - Layered API (golang) if you want to sandbox other things - Self-contained binary. No external requirements other than the backends you want to use. Defaults to a ~/.yoloai dir for config/data, but you can point it anywhere. - FOSS https://github.com/kstenerud/yoloai |