Drop Introduces a Rootless Linux Sandbox With Optional gVisor Support

The author said the tool grew out of unease about installing and running third-party programs under a main user account. In that setup, a single compromised dependency means a full compromise of the system. The author added a second concern: because they ship software from their own computer, one compromised dependency could also expose every user of that software.

Containers and virtual machines are one answer, the author wrote, but for local work they often work against productivity. Building a machine with all the tools and configurations needed for day-to-day work takes effort, and a container or VM is stripped of those tools. That is useful for production deployments aiming at a reproducible system with minimal dependencies, but it can get in the way of local work.

Drop is language independent, though its workflow is inspired by Python's virtualenv. The author draws a distinction between the two: with virtualenv, isolation is a convention that depends on installed dependencies behaving as good citizens, while Drop enforces the isolation. Each Drop environment receives its own writable and easily disposable home directory, and only selected configuration files and directories from the original home directory are mounted, mostly read-only.

For isolation, Drop uses Linux namespaces covering user, mount, network, PID, IPC and cgroup. It does not require root. As an option, it can use the gVisor user-space kernel, which the author says adds protection against exploits of host kernel vulnerabilities used to escape the sandbox.

The author said the introductory post was kept short and offered to answer questions and provide further technical detail. The post notes that this is the third submission of the project; the first two drew no attention. Since then, the author wrote, support for gVisor has been added and a project website created to explain the concept and organize documentation. The Hacker News listing showed 19 points and 2 comments.