Show HN: Fence – Sandbox CLI commands with network/filesystem restrictions

Post by jy-tan » Mon, Jan 26, 2026, 5:37 AM UTC

vivzkestrel wrote: post #21

jy-tan wrote: post #20

Earlier quoted context omitted.

Yes, Fence is designed for exactly this, the built-in `code` template already allowlists npm and PyPI registries: ``` fence -t code pip install requests fence -t code npm install express ``` This restricts writes to workspace + cache dirs, blocks reading credentials, limits network to allowlisted domains, and blocks dangerous commands (`rm -rf`, `npm publish`, etc).

thank you for the response, - how would you go about deploying this on an aws ecosystem? ec2 server? lambda? fargate? - basically i want to run untrusted user code for many programming languages inside a sandbox and i am looking for solutions to do so - need to be able to install libraries from pip, npm, cargo , just about any programming language's package manager

Post by jy-tan » Mon, Jan 26, 2026, 6:21 PM UTC

whinvik wrote: post #23

Thanks. I was sure someone was going to make this sooner rather than later and this one seems relatively easy to configure. I got tired of setting individual allow lists for each CLI, hopefully now I can run them all in Yolo mode while fence does the centralized sandboxing.