Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Zerobox – Sandbox any command with file, network, credential controls

github.com

Post reply on HN
Print view View original

61–70 of 108 posts

Re: Show HN: Zerobox – Sandbox any command with file, network, credential controls

#61

Post by simonw »

afshinmeh wrote: post #59
simonw wrote: post #56

Earlier quoted context omitted.

How about on macOS?

On macOS, the proxy is best effort. Programs that ignore HTTPS_PROXY/HTTP_PROXY can connect directly. This is a platform limitation (macOS Seatbelt doesn't support forced proxy routing). BUT, the default behaviour (no net) is fully enforced at the kernel level. Domain filtering relies on the program respecting proxy env vars.

I thought seatbelt-exec had mechanisms for that?

  (allow network-outbound
    (remote tcp "127.0.0.1:8080"))

Re: Show HN: Zerobox – Sandbox any command with file, network, credential controls

#63

Post by afshinmeh »

dk8996 wrote: post #62

Very cool. Is there a way to have a notion of a session, saving state between runs?

No, it's stateless right now. What is your requirement though? How do you define a session? Are you referring to "snapshotting" between sessions?

Re: Show HN: Zerobox – Sandbox any command with file, network, credential controls

#64

Post by afshinmeh »

simonw wrote: post #61
afshinmeh wrote: post #59

Earlier quoted context omitted.

On macOS, the proxy is best effort. Programs that ignore HTTPS_PROXY/HTTP_PROXY can connect directly. This is a platform limitation (macOS Seatbelt doesn't support forced proxy routing). BUT, the default behaviour (no net) is fully enforced at the kernel level. Domain filtering relies on the program respecting proxy env vars.

I thought seatbelt-exec had mechanisms for that? (allow network-outbound (remote tcp "127.0.0.1:8080"))

It does but because I'm inheriting the seatbelt settings from Codex, I'm not resetting it in Zerobox (I thought it's a safer option). Let me look into this, there should be a way to take Codex' profile and safely combine/modify it.

Re: Show HN: Zerobox – Sandbox any command with file, network, credential controls

#67

Post by hrmtst93837 »

eluded7 wrote: post #4

Personally I would probably always reach for a docker container if I want a sandboxed command that can run identically anywhere. I appreciate that alternate sandboxing tools can reduce some of the heavier parts of docker though (i.e. building or downloading the correct image) How would you compare this tool to say bubblewrap https://github.com/containers/

[flagged]

Re: Show HN: Zerobox – Sandbox any command with file, network, credential controls

#68

Post by afshinmeh »

jwilliams wrote: post #65

It’s terrific to see this. I’m definitely going to give it a whirl. I’ve been working on a specific JavaScript isolate[^1]. This is great source of inspiration for it. [^1]: https://github.com/jonathannen/hermit

I'd love to hear your thoughts! I've been primarily testing this with Bun + Vercel AI SDK for tool call sandboxing.

Re: Show HN: Zerobox – Sandbox any command with file, network, credential controls

#69

Post by afshinmeh »

simonw wrote: post #60
nonameiguess wrote: post #39

This is more a criticism of codex's linux-sandboxing, which you're just wrapping, but it's the first I've ever looked at it. I don't see how it makes sense to invoke bwrap as a forked subprocess. Bubblewrap can't do anything beyond what you can do with unshare directly, which you can simply invoke as a system call without needing to spawn a subprocess or requiring the user to have bwrap installed. It kinds of reeks o…

Is your criticism here that there's no point in invoking bwrap directly when you could instead implement the same things that bwrap implements? I'd much rather a system call bwrap than re-implement bwrap, because bwrap has already been extensively tested.

That was my thinking, too. The only other option would be reimplement it in Rust (never researched what exists though).
Post reply on HN