Show HN: Zerobox – Sandbox any command with file, network, credential controls
Zerobox is a lightweight, cross-platform process sandboxing tool that offers granular control over file access, network traffic, and environment variables with minimal overhead.
Lightweight, cross-platform process sandboxing powered by OpenAI Codex's sandbox runtime.
Deny by default: Writes, network, and environment variables are blocked unless you allow them.
Credential injection: Pass API keys that the process never sees. Zerobox injects real values only for approved hosts.
File access control: Allow or deny reads and writes to specific paths.
Network filtering: Allow or deny outbound traffic by domain.
Clean environment: Only essential env vars (PATH, HOME, etc.) are inherited by default.
TypeScript SDK: import { Sandbox } from "zerobox" with a Deno-style API.
Cross-platform: macOS and Linux. Windows support planned.
Single binary: No Docker, no VMs, ~10ms overhead.
Example usage:
zerobox --allow-read=. -- node script.js
Secrets are handled via a network proxy level substitution, ensuring the sandboxed process only sees a placeholder while the server receives the real key.
Source: Hacker News
