The best sandboxing tools, according to hackers

10 sandboxing tools recommended in Hacker News comments over the past year, ranked by how many separate people recommend each one.

All sandboxing tools

Bubblewrap (bwrap)A lightweight, flexible Linux sandbox for confining AI coding agents and untrusted programs to the files they need, though it shares the host kernel and complex setups get fiddly.109recommend
Agent SafehouseFree shell-script wrapper around macOS sandbox-exec that restricts coding agents to the current folder; people value its transparency and simplicity. Main caveat: it only works on macOS.43recommend
nonoRecommended as a free, kernel-enforced sandbox that keeps AI coding agents within set file and directory limits. Common caveat: getting access policies right takes work.34recommend
FirejailLinux sandbox that isolates applications with fine-grained permissions and pre-made profiles for common programs. Critics say it is not bulletproof and needs root or SUID privilege.30recommend
sandbox-execFree macOS built-in tool that people use to restrict what wrapped commands and coding agents can read and reach; it is hard to configure and poorly documented.25recommend
Bubblewrap (bwrap)A simple Linux sandbox for isolating apps and agents without running a full container. Critics say its limits are real and its isolation is weaker than it looks.11recommend
Apple SeatbeltBuilt-in macOS sandbox that restricts file and network access at the kernel level. Critics note it is deprecated, poorly documented and weak for containers.9recommend
MatchlockFree tool that runs AI agents in microVMs with deny-all networking and domain allowlisting, which people call the right design for the job.9recommend
SandboxieRecommended for isolating untrusted programs and attachments on Windows, and praised as powerful and long-lived.7recommend
MultituiRuns Claude, Codex, Gemini or other terminal tools inside a macOS sandbox without containers, with a UI for adding file access rules.7recommend