Matchlock
Shares rank 7 of 10 sandboxing tools by recommenders
Free tool that runs AI agents in microVMs with deny-all networking and domain allowlisting, which people call the right design for the job.
Free tool that runs AI agents in microVMs with deny-all networking and domain allowlisting, which people call the right design for the job.
11 people gave an opinion
- recommend it
- 9
- criticize it
- 2
- approval share
- 82%
Recommended in 3 of 13 months
- November 2025: not recommended
- December 2025: not recommended
- January 2026: not recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: not recommended
- May 2026: not recommended
- June 2026: not recommended
- July 2026: not recommended
- August 2026: not recommended
- September 2026: not recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 9 people recommend itNeeds 10 or more, not met.
- 4.5 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 3 of 13 monthsNeeds 4 or more, not met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Deny-all networking and domain allowlisting
“matchlock does have the network-layer controls you mentioned, such as domain whitelisting and secret protection toward designated hosts”
Comment from 8 Feb 2026 in “Matchlock: Linux-based sandboxing for AI agents” “the main thing matchlock adds over general-purpose vm/container tooling is agent specific network and filesystem (wip) controls”
Comment from 8 Feb 2026 in “Matchlock: Linux-based sandboxing for AI agents” “Matchlock intercepts and controls all network traffic by default, with deny-all networking and domain allowlisting.”
Comment from 8 Feb 2026 in “Matchlock: Linux-based sandboxing for AI agents” Designed for AI agent sandboxing
“the main thing matchlock adds over general-purpose vm/container tooling is agent specific network and filesystem (wip) controls”
Comment from 8 Feb 2026 in “Matchlock: Linux-based sandboxing for AI agents” “Matchlock[0] is probably the best solution I've come across so far WRT problem 1 and 2”
Comment from 9 Mar 2026 in “Agent Safehouse – macOS-native sandboxing for local agents” “I think matchlock is the right design for this context”
Comment from 23 Oct 2026 in “OpenShell – A safe, private runtime for fleets of autonomous AI agents” Stronger isolation than containers
“the main thing matchlock adds over general-purpose vm/container tooling is agent specific network and filesystem (wip) controls”
Comment from 8 Feb 2026 in “Matchlock: Linux-based sandboxing for AI agents” “The microVM is the real isolation boundary — seccomp is defense in depth.”
Comment from 8 Feb 2026 in “Matchlock: Linux-based sandboxing for AI agents” “even more secure alternative”
Comment from 12 Feb 2026 in “Matchlock: Linux-based sandboxing for AI agents” Usable base features and performance
“I like the base features you built in.”
Comment from 8 Feb 2026 in “Matchlock: Linux-based sandboxing for AI agents” “Mostly for performance and usability.”
Comment from 8 Feb 2026 in “Matchlock: Linux-based sandboxing for AI agents”
Other sandboxing tools people recommend
The four most recommended other sandboxing tools, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| Bubblewrap (bwrap) | 109 | 32 | 77% | 12 | — | Approved |
| Agent Safehouse | 43 | 2 | 96% | 7 | — | Approved |
| nono | 34 | 3 | 92% | 10 | — | Approved |
| Firejail | 30 | 6 | 83% | 12 | — | Approved |
| MatchlockThis page | 9 | 2 | 82% | 3 | — | — |
What people said
14 of the 16 comments that mention it, newest first. Each links to the original comment.
“I think matchlock is the right design for this context”
“Matchlock[0] is probably the best solution I've come across so far WRT problem 1 and 2”
“even more secure alternative”
“This is well cool, I swear to god a couple of kickass devs told me about this idea”
“It performs reasonably well with nested virtualisation.”
“I don't think the current filepath.Join in realfs.go protects the host against a malicious guest, at all.”
“nice - I was wondering about the cross-platform story”
“the main thing matchlock adds over general-purpose vm/container tooling is agent specific network and filesystem (wip) controls”
“matchlock does have the network-layer controls you mentioned, such as domain whitelisting and secret protection toward designated hosts”
“You're advocating for installing random (?kernel) level software from the internet.”
“I like the base features you built in.”
“The microVM is the real isolation boundary — seccomp is defense in depth.”
“Matchlock intercepts and controls all network traffic by default, with deny-all networking and domain allowlisting.”
“Mostly for performance and usability.”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.