Zerobox CLI
A sandbox for commands and agent-written code: writes, network and environment variables are closed by default, keys are injected only for allowed domains
- 724 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- Executes any command passed to it, and the `-A` and `--no-sandbox` flags remove isolation entirely
- Accepts API keys in command-line arguments, and the network proxy substitutes them into requests to hosts
- The `--restore` mode overwrites tracked files in the working folder with their pre-run state
Install
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/zeroboxDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Executes any command passed to it, and the `-A` and `--no-sandbox` flags remove isolation entirely
- Accepts API keys in command-line arguments, and the network proxy substitutes them into requests to hosts
- The `--restore` mode overwrites tracked files in the working folder with their pre-run state
This is third-party code. Review the repository files before installing.
What it does
Zerobox runs any command in isolation using the system's own tools: Seatbelt on macOS and Bubblewrap, Seccomp and namespaces on Linux. Without permissions a process writes nothing to disk, reaches no network and gets only basic environment variables such as `PATH` and `HOME`. Permissions are set with flags: `--allow-write=.` opens writing to the current folder, `--allow-net=api.openai.com` opens one domain, and `--deny-read` and `--deny-write` close individual paths and override allows. A typical call looks like this: `zerobox --allow-write=./dist -- npm run build`. Keys have a separate path. With `--secret OPENAI_API_KEY=...` the process inside the sandbox sees only a placeholder, and the network proxy substitutes the real value into a request to the host from `--secret-host`. Without `--secret-host` the key goes to any domain. The `--snapshot` flag records filesystem changes made while the command runs, `--restore` rolls tracked files back on exit, and `zerobox snapshot list`, `diff` and `restore` let you review a recording later. The isolation code is taken from the OpenAI Codex sandbox. Besides the binary, the package offers SDKs for Rust, TypeScript and Python with the same permission set, which is handy when an agent's tool calls must be confined one by one.
Who it is for. For developers who run agent-written code and commands on their own macOS or Linux machine and do not want to set up Docker or a virtual machine for it.
Good fit when
- An agent generated a script and you need to run it without network and with writes to a single folder only
- A build or dependency install must run with network but write only to `./dist`
- An OpenAI or GitHub key must work inside a process without sitting in its environment variables
- After `npm install` you want a list of changes and a way to roll them back with `zerobox snapshot restore`
- Tool calls of an agent in TypeScript or Python must be confined one by one through the SDK
Not a fit when
- You work on Windows: support is planned, only macOS and Linux work now
- You need to run a program with a graphical window, such as Chrome or Firefox: on macOS such apps cannot be sandboxed because of WindowServer
- You need a full environment with a browser and terminal for an agent: AIO Sandbox in Docker fits better
- You need a ready MCP server or skill: Zerobox ships a CLI and SDKs with no agent integration
Example request
Run the generated task.py script in a Zerobox sandbox: writes only to /tmp/output, network closedLimitations
- It runs on macOS and Linux. Windows support through restricted tokens and a firewall is planned.
- On Ubuntu 24.04 and newer unprivileged namespaces are disabled through AppArmor, and they must be enabled for the Linux sandbox. The `--strict-sandbox` flag stops if full isolation cannot be obtained, and without it a fallback to a weaker one is possible.
- On macOS the `--allow-read` flag leaves system paths such as `/etc` open, and `-A` and `--no-sandbox` remove protection entirely.
- A secret without `--secret-host` is substituted for all domains. Node.js does not honor `HTTPS_PROXY` on its own, and inside a sandbox with secrets it needs the `--use-env-proxy` argument.
- The overhead of about 10 ms and 7 MB per launch was measured by the developer on an Apple M5 Pro, and other machines will differ.
How to disable. Zerobox affects only the commands you launch through it: drop the `zerobox --` prefix from a call and the protection is gone. The package is removed the way it was installed, for example `npm uninstall -g zerobox` or `pip uninstall zerobox`. Snapshot records are cleaned with `zerobox snapshot clean --older-than=<days>`.
FAQ
How do I run agent-written code in a sandbox without Docker?
Install Zerobox and run `zerobox -- python3 /tmp/task.py`. Writes and network will be closed. To let the script write to one folder, add `--allow-write=/tmp/output`.
How do I pass an API key to a process so it cannot see it?
Use `--secret OPENAI_API_KEY=sk-... --secret-host OPENAI_API_KEY=api.openai.com`. Inside the sandbox the variable holds a placeholder, and the proxy swaps in the real value only for requests to the named host.
How do I roll back changes a command made?
Run with `--restore` and tracked files return to their pre-run state on exit. Or record changes with `--snapshot` and later run `zerobox snapshot diff <id>` and `zerobox snapshot restore <id>`.
How is Zerobox different from a Docker sandbox?
It is a single binary with no containers or virtual machines and it uses the system's own isolation mechanisms. The author puts the overhead at about 10 ms, while a Docker sandbox brings up a separate environment.
What do I do on Ubuntu 24.04 if the sandbox does not start?
In these versions AppArmor disables unprivileged namespaces by default, and Bubblewrap relies on them. Enable them in the system settings or run with `--strict-sandbox` to get an explicit error instead of a quiet fallback to weak isolation.
Discussion
No questions or reviews yet.
Related
CLI toolsThe safehouse command runs Claude Code, Codex and other agents in a macOS sandbox: files are closed by default and you open folders with flags
cli sandbox for ai agents without containers or daemons: runs Claude Code, Codex, or OpenCode with restricted access to files, network, and credentials
Fence runs commands and agents like Claude Code in a sandbox: network blocked by default, file access and the command list set through config
A CLI with policies that intercepts dangerous AI agent commands like rm -rf, force push or reading .env before they run
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
VibeKit runs Claude Code, Codex and other CLI agents through a proxy that masks secrets in replies, keeps a log and can hold the agent in Docker
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Zerobox (this entry) | no | 724 | ||
| Fence | yes | 999 | runs commands and agents like Claude Code in a sandbox: network is closed by default, file access and commands are set by a configuration | |
| AIO Sandbox | no | key is optional | 6,217 | a Docker container with a browser, terminal, files, VS Code and MCP services inside to isolate agent actions |
README in short
The repository holds Rust sources with separate crates for snapshots, protocol and profiles, npm packages per platform and a Python SDK. The overview starts with a table of install methods, launch examples and a diagram of how the sandbox works, followed by sections on secrets, environment variables and platforms. The `examples` folder has three agent examples with the Vercel AI SDK and Vercel Workflow, and `bench` holds a benchmark script. Apache-2.0 license.