Zerobox
Command sandbox in Privacy & security
Sandboxes any command with file, network and credential limits using native OS tools at near-zero overhead. Caveat: new and experimental, and domain filtering depends on proxy settings.
Sandboxes any command with file, network and credential limits using native OS tools at near-zero overhead. Caveat: new and experimental, and domain filtering depends on proxy settings.
16 people gave an opinion
- recommend it
- 12
- criticize it
- 4
- approval share
- 75%
Recommended in 3 of 13 months
- November 2025: not recommended
- December 2025: not recommended
- January 2026: not recommended
- February 2026: not recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: not recommended
- July 2026: not recommended
- August 2026: not recommended
- September 2026: not recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 12 people recommend itNeeds 10 or more, met.
- 3 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 3 of 13 monthsNeeds 4 or more, not met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Granular file, network and credential controls
“you control what network access (e.g. `--deny-net *.amazonaws.com`) your agent has and you also get snapshotting out of the box”
Comment from 6 May 2026 in “Show HN: Tilde.run – Agent Sandbox with a Transactional, Versioned Filesystem” “Zerobox gives you granular file/network/credential controls with near zero overhead.”
Comment from 1 Apr 2026 in “Show HN: Zerobox – Sandbox any command with file and network restrictions” “Real secrets are never readable by any processes inside the sandbox”
Comment from 1 Apr 2026 in “Show HN: Zerobox – Sandbox any command with file and network restrictions” Works the same across platforms
“this looks nicely done! It's also nice that it's cross platform”
Comment from 2 Apr 2026 in “Show HN: Zerobox – Sandbox any command with file and network restrictions” “it works the same on all platforms”
Comment from 31 Mar 2026 in “Show HN: Zerobox – Sandbox any command with file and network restrictions” Low overhead, no latency issues
“Zerobox gives you granular file/network/credential controls with near zero overhead.”
Comment from 1 Apr 2026 in “Show HN: Zerobox – Sandbox any command with file and network restrictions” “No latency issues at all.”
Comment from 1 Apr 2026 in “Show HN: Zerobox – Sandbox any command with file and network restrictions” Deny-by-default network policy for agents
“you control what network access (e.g. `--deny-net *.amazonaws.com`) your agent has and you also get snapshotting out of the box”
Comment from 6 May 2026 in “Show HN: Tilde.run – Agent Sandbox with a Transactional, Versioned Filesystem” “the deny-by-default network policy also matters specifically for agent use”
Comment from 1 Apr 2026 in “Show HN: Zerobox – Sandbox any command with file and network restrictions”
What people warn about
Each mark is one comment
Early, experimental, may have escapes
“That trade looks saner for local runs, though it's new enough that I'd expect a few escapes before the rough egdes are gone.”
Comment from 1 Apr 2026 in “Show HN: Zerobox – Sandbox any command with file and network restrictions” “You should probably add a huge disclaimer that this is an untested, experimental project.”
Comment from 1 Apr 2026 in “Show HN: Zerobox – Sandbox any command with file and network restrictions” Blocklists are brittle and hard to get right
“Isn't it very brittle though? Anthropic changes some URL-s and it'll break.”
Comment from 1 Apr 2026 in “Show HN: Zerobox – Sandbox any command with file and network restrictions” “it’s blacklisting so kind of impossible to get right”
Comment from 1 Apr 2026 in “Show HN: Zerobox – Sandbox any command with file and network restrictions”
What people said
21 of the 24 comments that mention it, newest first. Each links to the original comment.
“you control what network access (e.g. `--deny-net *.amazonaws.com`) your agent has and you also get snapshotting out of the box”
“there would be a lot of value in just having a mode that logs all the file operations a script tries to make”
“this looks nicely done! It's also nice that it's cross platform”
“The `--build-profile` / `--profile` thing is a good idea”
“Linux by default allows all users to read CLI arguments of running processes.”
“This is the right direction.”
“That trade looks saner for local runs, though it's new enough that I'd expect a few escapes before the rough egdes are gone.”
“It’s terrific to see this.”
“Domain filtering relies on the program respecting proxy env vars.”
“You are using DNS proxy which is interesting and useful if a process doesn't respect the HTTPS_PROXY/HTTP_PROXY/etc. env vars”
“Zerobox gives you granular file/network/credential controls with near zero overhead.”
“Zerobox _does_ use the native OS sandboxing mechanisms (e.g. seatbelt) under the hood.”
“Isn't it very brittle though? Anthropic changes some URL-s and it'll break.”
“Real secrets are never readable by any processes inside the sandbox”
“the deny-by-default network policy also matters specifically for agent use”
“the CLI interface design is solid, and I especially like the secrets / network proxy pattern”
“No latency issues at all.”
“You should probably add a huge disclaimer that this is an untested, experimental project.”
“it’s blacklisting so kind of impossible to get right”
“Cool project, and I think there would be a lot of value in just logging all operations.”
“it works the same on all platforms”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.