{"slug": "show-hn-agent-run-run-a-coding-agent-in-a-sandboxed-environment", "title": "Show HN: Agent-run – Run a coding agent in a sandboxed environment", "summary": "Developer sin-ack released Agent-run, a tiny standalone binary that runs coding agents like Pi, OpenCode, Codex, and Claude in a sandboxed Linux environment using bwrap. The tool, available on GitHub, uses TOML-based configuration and supports network control, environment inheritance, and custom mount paths for security.", "body_md": "Run a coding agent in a sandboxed environment.\n\n- Tiny standalone binary (<1MB). Runs on any recent GNU/Linux system\n.[1](#user-content-fn-1-8e9ea021c3941e1ab2eafa8c3610e2e7) - Simple TOML-based configuration.\n- JSON schema for config assistance.\n\n- Use one of the installation methods below.\n- Write your\n[configuration](#configuration). - Run your agent:\n`agent-run <pi|opencode|codex|claude>`\n\n.\n\nThat's it!\n\nNote\n\nagent-run uses bwrap so it only works on a Linux system. Additionally you need unprivileged user namespaces enabled.\n\nRun directly from the flake:\n\n```\nnix run github:sin-ack/agent-run -- <command>...\n```\n\nOr install it into your profile:\n\n```\nnix profile install github:sin-ack/agent-run\n```\n\nRun: `mise use github:sin-ack/agent-run@latest`\n\n(You might need to pass `--before 0d`\n\nto get the latest release, due to Mise's\ndate filters.)\n\n- Download the binary from the latest release:\n[https://github.com/sin-ack/agent-run/releases/latest](https://github.com/sin-ack/agent-run/releases/latest) - Put it somewhere in your PATH, e.g.\n`$HOME/.local/bin`\n\n.\n\nDon't forget to `chmod +x`\n\n!\n\nConfiguration is in TOML. There is a JSON schema you can use with tools like\n[Taplo](https://taplo.tamasfe.dev/) to get completions in your editor (see\nbelow).\n\n`agent-run`\n\nfinds its configuration in two ways:\n\n- An explicit\n`--config`\n\nargument - The closest\n`.agent-run/config.toml`\n\nin the directory hierarchy\n\nIf no configuration is found, the following default configuration is used:\n\n```\n[global]\nnetwork = true\ninherit_env = true\n```\n\nThe tool configuration to use is selected by looking at the basename of the first argument of the command.\n\nCurrently, no configuration merging across multiple configs is done. This might change later.\n\n```\n# Add this line to your TOML file to add support for completion:\n#:schema https://github.com/sin-ack/agent-run/raw/master/schema.json\n\n[global]\nmount = [\n    # Mount the user cache so tools that need it can write to it.\n    \"~/.cache\",\n    # Make the project directory writable.\n    \"..\",\n]\n\n[tools.pi]\nmount = [\n    # Allow access to pi's own directory.\n    \"~/.pi\",\n    # Pi writes bash outputs to /tmp/pi-bash-*.log so we must make all of /tmp\n    # writable.  :(\n    \"/tmp\",\n]\n\n[tools.codex]\nmount = [\"~/.codex\"]\n\n[tools.opencode]\n# OpenCode extracts its native OpenTUI library to TMPDIR so we need a writable\n# tmpdir for it.  Make sure /tmp/opencode exists before running agent-run.\nenv = [\"TMPDIR=/tmp/opencode\"]\nmount = [\n    \"/tmp/opencode\",\n    \"~/.cache/opencode\",\n    \"~/.config/opencode\",\n    \"~/.local/share/opencode\",\n    \"~/.local/state/opencode\",\n]\n\n[tools.claude]\nmount = [\n    \"~/.claude\",\n    # Workspace trust requires ~/.claude.json.  It must exist before launching\n    # agent-run.\n    \"~/.claude.json\",\n]\n```\n\nConfiguration in `agent-run`\n\nconsists of \"tool configs\". There is a global tool\nconfig under `global`\n\nand one for each tool you define under `tools.<name>`\n\n.\nTool configs have the following keys:\n\n`inherit_env`\n\n: Whether to inherit the environment variables from host. Defaults to true.`network`\n\n: Whether to allow network access within the sandbox. Defaults to true.`mount`\n\n: Paths to mount as read-write. The host filesystem is always mounted read-only; this only makes certain paths writable. Tildes are expanded. Environment variables are not expanded. If the path is relative, it is treated as relative to the configuration file itself. Absolute paths are passed as-is. We always identity-mount into the sandbox. If the given path is not found a diagnostic warning is printed and the path is left read-only.`env`\n\n: Environment variables to pass to the sandbox. If`inherit_env`\n\nis true, this is merged into the host environment variables. Each argument is a string in one of two forms:`KEY=VALUE`\n\n: Set`KEY`\n\nto`VALUE`\n\n.`VALUE`\n\ncan be the empty string in which case it is set to the empty string in the sandbox too.`KEY`\n\n: Pass`KEY`\n\nfrom the host environment through. If the variable is unset, it is left unset in the sandbox. Otherwise,`KEY`\n\nis set to the host environment variable's value.\n\nFor a full reference see [schema.json](/sin-ack/agent-run/blob/master/schema.json).\n\nThe environment variable `RUST_LOG`\n\nis respected, and supports `debug`\n\nand\n`trace`\n\nfor compact and verbose debug logs respectively.\n\nClaude Code stores workspace trust in `~/.claude.json`\n\n, not in `~/.claude`\n\n.\nBoth paths must therefore be writable (and must exist before `agent-run`\n\nstarts):\n\n```\n[tools.claude]\nmount = [\"~/.claude\", \"~/.claude.json\"]\n```\n\nYou need the following:\n\n```\n[tools.opencode]\nmount = [\n    \"/tmp/opencode\",\n]\nenv = [\"TMPDIR=/tmp/opencode\"]\n```\n\nBun tries to extract bundled libraries to TMPDIR but fails by default.\n\n- Permission prompts are annoying.\n- I want the agent to do anything it wants as long as it can't touch non-project files. I don't care about overlays, parallel agents or other fancy features.\n- I want a small and simple tool, ideally just one binary I can put into my\n`bin/`\n\n. - I want basic per-tool configurability.\n\nNothing satisfied all of these criteria so I made my own.\n\n`agent-run`\n\nis primarily intended to catch *mistakes* made by agents. Arbitrary\nmalicious code is not guaranteed to be handled perfectly safely. In particular,\nbecause the entire file system is exposed as read-only, information stealing\n(when network access is enabled) and things like writing to user-writable socket\nfiles is still possible. If this is your threat model, consider using things\nlike microVMs.\n\n- We build a\nbinary for the target.`bwrap`\n\n- We embed it inside the binary and exec into it via memfd, passing it the appropriate arguments from the config.\n\nYou need [Bazel](https://bazel.build). I recommend using\n[Bazelisk](https://github.com/bazelbuild/bazelisk).\n\n- Run it via Bazel:\n`bazel run --run_in_cwd //:agent-run -- [args...]`\n\n- Build a release binary:\n`bazel build --config=size --platforms=//platforms:[target] //:agent-run`\n\n- Run tests (including Clippy):\n`bazel test //...`\n\n- Run Clippy only:\n`bazel test //:clippy_test`\n\n- Regenerate third-party license notices (requires\n):`cargo-about`\n\n`tools/update-third-party-licenses.sh`\n\nThis project is licensed under the GNU General Public License, version 3.\nSee [LICENSE](/sin-ack/agent-run/blob/master/LICENSE) for details. See\n[THIRD_PARTY_LICENSES.md](/sin-ack/agent-run/blob/master/THIRD_PARTY_LICENSES.md) for third-party license\nnotices.\n\n## Footnotes\n\n-\nCurrently aarch64 and x86_64 are directly supported.\n\n[↩](#user-content-fnref-1-8e9ea021c3941e1ab2eafa8c3610e2e7)", "url": "https://wpnews.pro/news/show-hn-agent-run-run-a-coding-agent-in-a-sandboxed-environment", "canonical_source": "https://github.com/sin-ack/agent-run", "published_at": "2026-07-12 21:15:56+00:00", "updated_at": "2026-07-12 21:35:13.852949+00:00", "lang": "en", "topics": ["developer-tools", "ai-agents", "ai-tools"], "entities": ["sin-ack", "Agent-run", "GitHub", "Pi", "OpenCode", "Codex", "Claude"], "alternates": {"html": "https://wpnews.pro/news/show-hn-agent-run-run-a-coding-agent-in-a-sandboxed-environment", "markdown": "https://wpnews.pro/news/show-hn-agent-run-run-a-coding-agent-in-a-sandboxed-environment.md", "text": "https://wpnews.pro/news/show-hn-agent-run-run-a-coding-agent-in-a-sandboxed-environment.txt", "jsonld": "https://wpnews.pro/news/show-hn-agent-run-run-a-coding-agent-in-a-sandboxed-environment.jsonld"}}