Drop

Drop is a rootless Linux sandbox for developers. It isolates coding agents and third-party packages while preserving your work environment. Inspired by Python's virtualenv, Drop lets you create and enter easily disposable environments. Each environment has its own home directory while the original home is hidden. Unlike Docker/Podman, Drop uses your existing distribution, so there is no container setup work: every program you've already installed is available in the sandbox. Drop doesn't require root to run. It runs within a Linux user namespace, with its own process, mount, network, IPC and cgroup namespaces. Drop drops all the user namespace capabilities before executing a sandboxed program, so the program cannot do privileged operations within the user namespace, like bind mounts. As an option, Drop supports running programs on the gVisor user-space kernel. This is an additional isolation layer that prevents programs from accessing the host kernel directly, significantly reducing the potential to exploit kernel vulnerabilities.