Drop is a sandbox for running something you do not trust on the machine you already use. It is a Go binary, and the pitch is that an environment is entered and thrown away like a virtualenv rather than built like an image. Each environment gets its own home directory with the real one hidden, inside a user namespace with its own process, mount, network, IPC and cgroup namespaces. Every user-namespace capability is dropped before the program executes, so privileged operations inside the namespace are out, bind mounts among them. gVisor can be layered underneath, so the program never reaches the host kernel directly.
Because it borrows the distribution rather than a container image, everything already installed is available inside the sandbox. Networking needs the passt/pasta package. A TOML config decides which files, directories and local services are visible, and environments share a base config by default, so a new one needs no configuration at all.
What it is for
Two use cases, both from the project’s own site. Coding agents run with --dangerously-skip-permissions, where a hallucinated rm -rf ~ cannot reach the real home directory, a prompt injection aimed at ~/.ssh finds nothing, and a connection to a service on localhost is refused. And packages from PyPI, npm or anywhere else, where a compromised dependency stays inside the sandbox.
Installing it
Prebuilt binaries are on the release page, or CGO_ENABLED=0 go install github.com/wrr/drop/cmd/drop@latest with Go 1.25 or newer. Two distro-specific steps are documented. On Ubuntu 24 the binary needs an AppArmor profile before it is allowed to use user namespaces. On Fedora, the SELinux policy does not cover pasta’s access to the namespace files of unconfined processes, so Drop exits with netns dir open: Permission denied until a small policy module is installed.
My read
The shape is the idea: a sandbox you enter from a shell rather than a container you build and orchestrate, using the distribution you already run. What it is not is a separate kernel. Rootless user namespaces put the isolation in the host kernel, so the escape is a kernel bug, which is exactly why gVisor is offered alongside.
The two distro-specific steps are the honest part of the install. Letting unprivileged processes create namespaces still is not something a distribution does without a policy exception.
Source: Drop sandbox for Linux, with the passt and distro setup from its installation documentation