Ask HN: Secure wrapper for coding agents?

I believe you're looking for Era. It uses libkrun for local microVM isolation and was built specifically to solve the "LLM hallucinated a destructive bash command" problem without the overhead of a massive VM.

Another one that handles this gracefully is Yolobox, which uses rootless Podman. Both are actively maintained and cut through the noise of the thousands of generic wrapper repos out there right now.

Have you thought About docker?

Docker has introduced sandboxes for this purpose.

If you are running MacOS, I would recommend Agent Safehouse. Well maintained and is built on existing sandbox-exec so you are not locked in and can always build your own rules independent of the CLI tool.

https://github.com/eugene1g/agent-safehouse/ https://agent-safehouse.dev/

Originally posted on HN https://news.ycombinator.com/item?id=47301085

If you're on a mac, lookup https://bromure.io/en/agentic-coding

(Lookup the browser too: https://bromure.io/en/secure-web)

Everything you see is made by Claude (and Renaud Deraison :-)) and working quite well jugding from the demos)

See here for more details (in french but English subs available (and more)): https://www.sstic.org/2026/presentation/cloture_2026/

Take a look at https://github.com/Tako-Research/TakoVM!

agent-pd was posted as a Show HN fairly recently, might be what you are remembering? https://github.com/varmabudharaju/agent-pd/

for coding agents, i care less about sandbox branding and more about boring audit logs. what did it read, what did it write, and what was blocked?

[dead]

This may be too naive, but I created a user on my linux box who doesn't have very many permissions. Then I sudo to that user, use firejail to start pi in a dev project directory, and let it have at it.

My projects are usually very limited with respect to external dependencies and that is part of prompts or markdown files describing various project goals, plans, and current state.

My operating theory is that this probably won't get my systems borked. I wasn't patient enough to dig deeper.

[dead]

I build a local, cross platform virtual machine for this purpose: https://github.com/smol-machines/smolvm

[flagged]

[flagged]

Celesto has an unified interface for sandboxes based on QEMU, Firecracker and Libkrun.

https://docs.celesto.ai/smolvm

Beside from particular project, I would like to talk about my rule of thumb in agent usage, which is to separate “smart” from “authorized.”

That is, to build a state wrapper and separate agent from making runtime decision, a dangerous design is letting the same agent both decide and record the state of the system. If it hallucinates, you can hardly find the error.

[flagged]