# Drop

Linux sandboxing that doesn't get in your way

Source: https://wheredoirunthis.com/products/drop · JSON: https://wheredoirunthis.com/api/products/drop · Read on 2026-09-25

## At a glance

- Type: Sandbox
- Kind: Open source tool
- Isolation: Container
- Free tier: Not documented
- Starting price: Not disclosed
- GPU: Not documented
- Regions: Not disclosed
- Coverage: 3 of 55 assessed capabilities supported · 6 not assessed
- Agent readiness: read 5.5 of 10 signals, drive 1 of 6 signals

## Links

- Homepage: https://droprun.sh/
- Docs: https://droprun.sh/docs/
- Repository: https://github.com/wrr/drop

## Runtime

- **GPU & accelerators**: na — "Provisions no compute. Also 'Only a small set of basic devices is available in the sandbox', so host GPUs are not exposed by default." [source](https://droprun.sh/docs/sandbox-overview/) (confidence: high)
- **BYOC (Bring your own cloud)**: na
- **Secrets management**: Hide-by-default, no management. The real home (incl. ~/.ssh) is replaced by a per-env home. Only allowlisted env vars cross (`exposed_vars`, globs allowed), plus `set_vars`. Selected dotfiles are mounted read-only, and `blocked_paths` masks specific paths. The docs warn the user to review base.toml so no secret-bearing files or vars are exposed. There is no keystore integration or credential proxy: any secret an agent needs must be placed inside the sandbox. — "'Review the generated settings, ensure that no files with secrets are exposed' / 'Do not expose variables containing secrets.'" [source](https://droprun.sh/docs/configuration/) (confidence: high)
- **Storage options**: Own root filesystem via a mount namespace. /usr,/bin,/sbin,/lib* are read-only from the host, /etc is a read-only overlay, and home, /var and /tmp are per-env writable. Fresh /proc,/sys,/run,/dev with only null/zero/full/random/urandom devices. The TOML `mounts` list exposes extra host paths (read-only by default, `:rw` opt-in), and the per-run `--mount` flag adds more. — "'Drop uses a mount namespace to arrange its own root filesystem, hiding the original host filesystem. System dirs are exposed from the host read-only, each Drop environment gets its own persistent home dir, `/var` and `/tmp`, and only a few basic devices are available.'" [source](https://droprun.sh/docs/sandbox-overview/) (confidence: high)
- **Supported workloads**: ai-coding-agents (Claude Code run with --dangerously-skip-permissions), untrusted third-party packages (PyPI/npm installs, supply-chain containment), interactive developer shells — "Use cases: 'Isolate coding agents' / 'Isolate third-party programs'." [source](https://droprun.sh/) (confidence: high)
- **Persistence**: Per-environment persistent state on the host disk. Each env has its own writable home, /var and an /etc overlay upper dir under ~/.local/share/drop/envs/<id>/, plus /tmp under /tmp/drop-$USER/. All of it survives across `drop run` invocations until `drop rm`. The project dir where `drop init` ran is bind-mounted read-write (its .git read-only), so project work lands directly in the real tree. — "'Drop environments are persistent. If a process started by `drop run` terminates, the environment is still there and the files created by the process are kept.'" [source](https://droprun.sh/docs/running/) (confidence: high)
- **Data jurisdiction**: na
- **Resource limits & quotas**: No resource limits (no CPU/memory/pids caps are documented or configurable. A cgroup namespace is used for isolation, not for limits). Documented limitations: terminal only (no GUI by default), no sound/extra devices, setuid programs don't run, and programs that need user namespaces themselves (Podman, Snap-installed programs) are unsupported. Linux amd64/arm64 only. — "'Current limitations' section of sandbox-overview + README. No limit settings in the configuration reference." [source](https://droprun.sh/docs/sandbox-overview/) (confidence: high)
- **SDK languages**: Not documented — "No SDK: the CLI is the only interface, and the Go packages are under internal/." [source](https://droprun.sh/docs/installation/) (confidence: high)
- **Network & egress controls**: Coarse, local-focused. `net.mode = off` cuts all network. The default `isolated` mode gives a separate netns via pasta, full internet access, and DEFAULT-DENY to host localhost services, with per-port allowlists (tcp_host_ports / udp_host_ports). Inbound is opt-in port publishing (tcp/udp_published_ports, incl. an `auto` mode). There is NO remote domain/IP allowlist and no egress proxy. — "'mode = "isolated" (default) - programs in the sandbox can access remote services. Port mapping settings below determine which services running in the sandbox can be accessed from the host and which services running on the host can be accessed from the sandbox.'" [source](https://droprun.sh/docs/configuration/) (confidence: high)
- **Snapshots & forks**: None. There is no snapshot, clone or rollback of an environment. — "Commands are only init / run / ls / rm / update --check." [source](https://droprun.sh/docs/running/) (confidence: high)
- **Deployment methods**: cli — "`drop init [ENV_ID]`, `drop run [-e ENV_ID] [command...]`, `drop ls`, `drop rm`, plus TOML config in ~/.config/drop/ (base.toml + <envid>.toml)." [source](https://droprun.sh/docs/running/) (confidence: high)
- **Isolation**: Container — "DEFAULT `native` runtime: 'Uses Linux namespaces (user, mount, PID, IPC, cgroup and network) to isolate sandboxed programs from the host.' + 'Drops all the capabilities before starting a sandboxed program'. These are the shared-kernel container primitives without an OCI image or daemon (rootless, runs as the invoking user), so the value is `container`. OPT-IN `gvisor` runtime: 'sandboxed programs run on the gVisor user-space kernel' (requires `runsc`), which would be `kata-gvisor-microvm`; it can be switched per environment or per run (`--runtime gvisor`). Medium confidence because the enum has no 'rootless namespaces, no image' value and the primary deliberately records the default, not the stronger option. No seccomp or Landlock layer in the native runtime (source grep). A CVE-2019-5736-style /proc/self/exe overwrite is explicitly mitigated by exec'ing via root-owned /usr/bin/env (internal/command/run.go, and the maintainer's 2026-06-12 blog post)." [source](https://droprun.sh/docs/sandbox-overview/) (confidence: medium)

## Capabilities

### AI & agents

| Capability | Status | Evidence |
| --- | --- | --- |
| Agent skills | Not supported | "Documentation for Drop, a rootless Linux sandbox for developers" [source](https://droprun.sh/docs/) |
| AI app builder | Not supported | "Linux sandboxing that doesn't get in your way" [source](https://droprun.sh/) |
| Autonomous QA agent | Not supported | "Isolate coding agents" [source](https://droprun.sh/) |
| Built-in coding agent | Not supported | "Isolate programs and coding agents without leaving your familiar work environment" [source](https://droprun.sh/) |
| BYOK for LLMs | Not supported | "Now let's install Claude Code using its .sh installer" [source](https://droprun.sh/docs/tour/) |
| Credential-injection proxy | Not supported | "`exposed_vars` - A list of environment variables to expose from the process starting Drop to the sandbox. [...] Do not expose variables containing secrets." [source](https://droprun.sh/docs/configuration/) |
| LLM gateway | Not supported | "Uses [pasta](https://passt.top) for networking." [source](https://droprun.sh/docs/sandbox-overview/) |
| MCP client | Not supported | "Drop: a rootless Linux sandbox for developers." [source](https://droprun.sh/docs/) |
| MCP-server hosting | Not supported | "Install programs from PyPI, npm or any other source without giving them full access to your user account." [source](https://droprun.sh/) |
| MCP server | Not supported | "Documentation for Drop, a rootless Linux sandbox for developers: installation, running, configuration, gVisor and a Claude Code coding agent tour." [source](https://droprun.sh/docs/) |
| Model inference API (first-party) | Not applicable | "Drop: a rootless Linux sandbox" [source](https://droprun.sh/) |
| Preinstalled coding agent | Not assessed |  |

### Networking & delivery

| Capability | Status | Evidence |
| --- | --- | --- |
| Automatic HTTPS | Not applicable | "`"8080"` - publish port 8080 from the sandbox as 127.0.0.1:8080 on the host" [source](https://droprun.sh/docs/configuration/) |
| Custom domains | Not applicable | "If host_ip is not specified, it defaults to 127.0.0.1." [source](https://droprun.sh/docs/configuration/) |
| Direct public IPv6 | Not applicable | "Uses [pasta](https://passt.top) for networking." [source](https://droprun.sh/docs/sandbox-overview/) |
| Edge KV store | Not applicable | "Drop: a rootless Linux sandbox" [source](https://droprun.sh/docs/sandbox-overview/) |
| Egress controls | Partially supported | "`mode = "off"` - programs in the sandbox cannot access remote or local network services. [...] `mode = "isolated"` (default) - programs in the sandbox can access remote services." [source](https://droprun.sh/docs/configuration/) |
| Email send / receive | Not supported | "By default disallows network access to services running on localhost. Uses [pasta](https://passt.top) for networking." [source](https://droprun.sh/docs/sandbox-overview/) |
| Public preview URLs | Not applicable | "An empty list means no ports are exposed." [source](https://droprun.sh/docs/configuration/) |
| Private networking | Partially supported | "`tcp_host_ports` - A list of localhost TCP ports open on the host that the sandbox can access." [source](https://droprun.sh/docs/configuration/) |
| Built-in reverse proxy | Not applicable | "`"8080:8000"` - publish port 8000 from the sandbox as 127.0.0.1:8080 on the host" [source](https://droprun.sh/docs/configuration/) |

### Organisation & security

| Capability | Status | Evidence |
| --- | --- | --- |
| Built-in auth | Not supported | "Drop doesn't require root and can't execute any operation that the current user is not allowed to execute." [source](https://droprun.sh/docs/sandbox-overview/) |
| BYOC | Not applicable | "Drop: a rootless Linux sandbox for developers." [source](https://droprun.sh/) |
| Deploy into customers' VPCs | Not assessed |  |
| Secrets management | Not supported | "Be sure not to expose files with secrets or other sensitive data. [...] Do not expose variables containing secrets." [source](https://droprun.sh/docs/configuration/) |
| Self-host / OSS core | Supported | "Apache License 2.0" [source](https://github.com/wrr/drop) |
| Sharing | Not applicable | "`"0.0.0.0/8080:8000"` - publish port 8000 from the sandbox as 8080 on the host, bind it to all the host's IP addresses." [source](https://droprun.sh/docs/configuration/) |
| SSO / SAML | Not supported | "Drop: a rootless Linux sandbox for developers." [source](https://droprun.sh/) |
| Teams | Not applicable | "Drop doesn't require root and can't execute any operation that the current user is not allowed to execute." [source](https://droprun.sh/docs/sandbox-overview/) |
| Workload identity | Not assessed |  |

### Developer access

| Capability | Status | Evidence |
| --- | --- | --- |
| CLI | Supported | "`drop init [ENV_ID]` creates a new Drop environment. [...] `drop run [-e ENV_ID] [command]` runs the command within the sandbox." [source](https://droprun.sh/docs/running/) |
| E2B-compatible API | Not assessed |  |
| Filesystem API | Not applicable | "Drop home dirs are stored in `~/.local/share/drop/envs/<id>/home`" [source](https://droprun.sh/docs/running/) |
| Git deploy | Not applicable | "`drop init` configures the created environment to have read-write access to the directory in which `drop init` was run, except for its `.git` subdirectory, which is read-only." [source](https://droprun.sh/docs/running/) |
| HTTP data API | Not applicable | "Drop: a rootless Linux sandbox" [source](https://droprun.sh/docs/sandbox-overview/) |
| OpenAPI spec | Not supported | "`drop COMMAND help` - prints command-specific help" [source](https://droprun.sh/docs/running/) |
| Private container registry | Not applicable | "Unlike Docker/Podman, Drop uses your existing distribution, so there is no container setup work" [source](https://droprun.sh/) |
| Public API | Not supported | "`drop help` - prints usage and available commands" [source](https://droprun.sh/docs/running/) |
| SDK | Not supported | "CGO_ENABLED=0 go install github.com/wrr/drop/cmd/drop@latest" [source](https://droprun.sh/docs/installation/) |
| SSH access | Not applicable | "Start a sandboxed shell in the `claude` environment: `drop run -e claude`" [source](https://droprun.sh/docs/tour/) |

### Compute & storage

| Capability | Status | Evidence |
| --- | --- | --- |
| Cloud-init / ignition config | Not applicable | "When `drop init` is run for the first time, it creates a `base.toml` config file, which is shared by all Drop environments." [source](https://droprun.sh/docs/configuration/) |
| Desktop / computer-use sandbox | Not supported | "Terminal only. GUI programs will not run in the sandbox with the default config." [source](https://droprun.sh/docs/sandbox-overview/) |
| GPU compute | Not supported | "Only a small set of basic devices is available in the sandbox, so it is not possible to, for example, play or record sound." [source](https://droprun.sh/docs/sandbox-overview/) |
| Live-state (memory) snapshots | Not assessed |  |
| Multi-region | Not applicable | "Uses Linux namespaces (user, mount, PID, IPC, cgroup and network) to isolate sandboxed programs from the host." [source](https://droprun.sh/docs/sandbox-overview/) |
| Object storage | Not applicable | "System dirs are exposed from the host read-only, each Drop environment gets its own persistent home dir, `/var` and `/tmp`" [source](https://droprun.sh/docs/sandbox-overview/) |
| Persistent disk | Supported | "Drop environments are persistent. If a process started by `drop run` terminates, the environment is still there and the files created by the process are kept." [source](https://droprun.sh/docs/running/) |
| Sandbox templates / custom images | Not supported | "Unlike Docker/Podman, Drop uses your existing distribution, so there is no container setup work: every program you've already installed is available in the sandbox." [source](https://droprun.sh/) |
| Scale to zero | Not applicable | "`drop run [-e ENV_ID] [command]` runs the command within the sandbox." [source](https://droprun.sh/docs/running/) |
| Selectable isolation runtime | Not assessed |  |
| Snapshots / forking | Not supported | "`drop ls` lists all the created environments; `drop rm` removes an environment and all its files." [source](https://droprun.sh/docs/running/) |

### Data

| Capability | Status | Evidence |
| --- | --- | --- |
| Database branching | Not applicable | "each Drop environment gets its own persistent home dir" [source](https://droprun.sh/docs/sandbox-overview/) |
| Ephemeral instant DB (no-signup) | Not applicable | "Drop: a rootless Linux sandbox" [source](https://droprun.sh/docs/sandbox-overview/) |
| First-party database | Not applicable | "each Drop environment gets its own persistent home dir, `/var` and `/tmp`" [source](https://droprun.sh/docs/sandbox-overview/) |
| Vector search | Not applicable | "Drop: a rootless Linux sandbox" [source](https://droprun.sh/docs/sandbox-overview/) |

### Platform & operations

| Capability | Status | Evidence |
| --- | --- | --- |
| Managed CI/CD runners | Not supported | "Drop's focus is productive UX for local workflows." [source](https://droprun.sh/) |
| Built-in observability | Not supported | "`DROP_GVISOR_DEBUG_LOG` - if set to a directory path, enables gVisor debugging and writes gVisor logs to this directory." [source](https://droprun.sh/docs/environment-variables/) |
| Preview environments | Not applicable | "Drop environments are persistent." [source](https://droprun.sh/docs/running/) |
| Scheduled tasks | Not supported | "`drop run [-e ENV_ID] [command]` runs the command within the sandbox." [source](https://droprun.sh/docs/running/) |
| Project template marketplace | Not applicable | "Drop: a rootless Linux sandbox" [source](https://droprun.sh/) |
| Durable workflows | Not applicable | "Drop's workflow is inspired by Python's virtualenv" [source](https://droprun.sh/docs/running/) |

## Agent readiness

### Read: 5.5 of 10 signals present

5.5/10 signals (5 full, 1 partial; 1 na): a clean server-rendered Hugo site with a sitemap and good meta, but no llms.txt, no JSON-LD and no markdown negotiation

- Llms txt: fail — "https://droprun.sh/llms.txt → 404 (also checked /docs/llms.txt via the docs tree: not present)"
- Llms full txt: fail — "https://droprun.sh/llms-full.txt → 404"
- Robots AI policy: partial — "https://droprun.sh/robots.txt is the single line 'User-agent: *' with no Disallow and no AI-UA mention, i.e. default-allow → half"
- JSON LD: fail — "No <script type=application/ld+json> on the homepage. Only itemprop microdata (name/description/image)."
- Sitemap: pass — "https://droprun.sh/sitemap.xml: 11 URLs covering home + all 8 docs pages"
- Meta quality: pass — "<title>Drop sandbox for Linux</title>, a descriptive meta description, og:title/og:url/og:image and a twitter:card with a description. og:description is absent, but twitter:description carries the same text."
- Markdown negotiation: fail — "Accept: text/markdown on / returns text/html, and /docs/tour.md → 404. (The markdown sources are public in the repo's website/content/, but the site does not serve them.)"
- Content efficiency: pass — "Homepage ≈6.5% readable text / HTML bytes (2,320 / 35,955), server-rendered Hugo"
- Docs discoverable: pass — "'Docs' in the header nav (/docs) plus an 'Install Drop' hero button. Every docs page is linked from the static HTML with no JS needed."
- Pricing machine readable: na — "Free Apache-2.0 tool with no pricing page. There is nothing to price."
- Anti bot: pass — "Served via Cloudflare (cf-cache-status: HIT). No challenge on any fetched page."

### Drive: 1 of 6 signals present

1/6 signals (1 full; 5 na: a local CLI with no hosted endpoint). The official CLI is the entire act surface: no API, SDK, MCP server or agent-config files.

- Public API: fail — "No HTTP/socket control API. The surface is the `drop` CLI + TOML config."
- Openapi spec: fail — "No spec. None referenced."
- MCP server: fail — "No Model Context Protocol mention anywhere on droprun.sh or in the README. /.well-known/mcp → 404."
- SDK packages: fail — "No SDKs. Go packages are under internal/ (not importable)."
- Auth docs: na — "No hosted API, so there is nothing to authenticate against."
- Agent self serve creds: na — "No accounts or keys exist. Install is a curl of a static binary, which is fully agent-executable, but there is no credential surface."
- Webhooks: na — "No service to emit events."
- CLI tool: pass — "Official `drop` CLI (init/run/ls/rm/update), static binaries for amd64/arm64 on every release"
- Error model: na — "No API."
- Rate limit docs: na — "No API."
- Agent config: fail — "No AGENTS.md/CLAUDE.md/skills in the repo (the .gitignore explicitly ignores CLAUDE.md and .claude), and no /.well-known/agent."

## Coding harnesses

- Claude Code (Anthropic) — "This tour demonstrates key characteristics of Drop. We will install and run Claude Code within Drop to work on a project stored in `~/project`. [...] (drop)alice@zax:~/project$ claude --dangerously-skip-permissions" [source](https://droprun.sh/docs/tour/)

## Open source

- Repository: https://github.com/wrr/drop
- License: Apache-2.0
- Stars: 299
- Forks: 9
- Self-host methods: binary, source-build
- Self-host dependencies: passt

## Company & presence

- Headquarters: Kraków, Poland (maintainer location; no company)
- Founded: 2025
- GitHub: https://github.com/wrr/drop
- Blog (maintainer's personal): https://mixedbit.org/blog/
- GitHub Sponsors: https://github.com/sponsors/wrr
- Hacker News (Show HN): https://news.ycombinator.com/from?site=droprun.sh

## Nearby in the atlas

- [Agent Safehouse](/products/agent-safehouse.md)
- [Agent Sandbox](/products/agent-sandbox.md)
- [Agent Substrate](/products/agent-substrate.md)
- [Agent37](/products/agent37.md)
- [AgentNest](/products/agentnest.md)
- [Anthropic Sandbox Runtime (srt)](/products/sandbox-runtime.md)

## Method

Facts come from the product's own public pages. Each claim carries its evidence: a quote and the page it came from. We count capabilities rather than grade products, and "Not assessed" means we have not checked, never that the product lacks it.