HN Showcase
Back to browse
GitHub Repository

Run any untrusted process with restricted filesystem and network access, using native OS primitives.

8 starsRust

Pent – A sandbox for AI agents

by rad_val·Mar 3, 2026·2 points·0 comments
Visit ProjectView on HN

AI Analysis

●●●BangerWizardryNiche Gem

Domain-allowlist network sandbox for any process—no VM, native Landlock and overlayfs.

Strengths
  • •Zero-config profiles (@claude, @gh, @npm, etc.) ship ready-to-use—usable in minutes.
  • •Native OS primitives (Landlock + overlayfs + network namespacing) mean fast overhead vs Docker/Firejail.
  • •Genuine security insight: filesystem path allowlisting + overlayfs shadowing is less error-prone than mount-bind-only approaches.
Weaknesses
  • •macOS network containment missing—only filesystem isolation via Seatbelt, asymmetric feature parity.
  • •Early adoption risk: Landlock is relatively new, adoption/stability not yet battle-tested at scale.
Category
Security
Target Audience

Developers running AI agents, scripts, or tools from untrusted sources who need fine-grained containment.

Similar To

Firejail · bubblewrap · Docker

Similar Projects