Lightweight sandbox tool for AI agents launches with no daemon or root needed

sandbox-bwrap-nix addresses a practical pain point for developers using AI coding agents: the fear of an agent running a destructive command like rm -rf on critical files or configuration directories. While containers like Docker and Podman offer isolation, they carry overhead—daemons, image management, layer caching, and the need for root privileges or sudo. The project takes a narrower, lighter approach by combining two existing Linux tools: bubblewrap (a minimal privilege-dropping sandbox) and Nix (which the project assumes users already have). The result is a tool that offers meaningful safety (isolated filesystem, separate process namespace, cleared environment variables) without the operational complexity of full containerization.

The design trade-offs are transparent: sandbox-bwrap-nix sacrifices portability (Linux and bubblewrap only) and some container features (no image caching, no separate OS kernel) in exchange for simplicity, speed, and a natural fit for developers already using Nix. The isolation model—mounting the Nix store as read-only, replacing the home directory with a throwaway sandbox-home folder, and using a fresh /tmp—means an AI agent can still be effective (it can install packages, edit files, run commands) but any damage or leftover changes stay inside the sandbox and can be erased by resetting the sandbox-home folder.