{"slug": "amla-sandbox", "name": "Amla Sandbox", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 3, "commenters": 4, "warners": 0, "score": 2.691, "rising": -0.98, "first": "2026-01-30", "latest": "2026-01-30", "why": "I really like Amla Sandbox addition of injecting tool calls into the sandbox", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 0, "compare": 1, "warn": 0}, "spark": [0, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "I really like Amla Sandbox addition of injecting tool calls into the sandbox", "kind": "", "icon": true, "domain": null, "github_repo": "github.com/coplane/localsandbox", "official_url": "https://github.com/coplane/localsandbox", "pricing": "", "aliases": ["Amla Sandbox"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 749298256, "item_id": 46831141, "url": "https://news.ycombinator.com/item?id=46831141", "by": "thepoet", "date": "2026-01-30", "stance": "recommend", "quote": "This looks cool, congratulations.", "excerpt": "This looks cool, congratulations. We investigated WASM for our use case but then turned to Apple containers which run 1:1 mapped to a microVM for local use here, which is being used by a bunch of folks https://github.com/instavm/coderunner We are currently also building a solution InstaVM which is ideologically the same but for cloud https://instavm.io", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Amla Sandbox \u2013 WASM bash shell sandbox for AI agents"}, {"id": 749240832, "item_id": 46827552, "url": "https://news.ycombinator.com/item?id=46827552", "by": "rellfy", "date": "2026-01-30", "stance": "recommend", "quote": "I really like the capability enforcement model, it's a great concept.", "excerpt": "I really like the capability enforcement model, it's a great concept. One thing this discussion is missing though is the ecosystem layer. Sandboxing solves execution safety, but there's a parallel problem: how do agents discover and compose tools portably across frameworks? Right now every framework has its own tool format and registry (or none at all). WASM's component model actually solves this \u2014 you get typed inte", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Amla Sandbox \u2013 WASM bash shell sandbox for AI agents"}, {"id": 749236224, "item_id": 46827264, "url": "https://news.ycombinator.com/item?id=46827264", "by": "simonw", "date": "2026-01-30", "stance": "recommend", "quote": "This project looks very cool", "excerpt": "This project looks very cool - I've been trying to build something similar in a few different ways (https://github.com/simonw/denobox is my most recent attempt) but this is way ahead of where I've got, especially given its support for shell scripting. I'm sad about this bit though: > Python code is MIT. The WASM binary is proprietary\u2014you can use it with this package but can't extract or redistribute it separately.", "context": "", "use_case": "WASM bash sandbox for agents", "switched_from": "", "story": "Show HN: Amla Sandbox \u2013 WASM bash shell sandbox for AI agents"}, {"id": 749221296, "item_id": 46826331, "url": "https://news.ycombinator.com/item?id=46826331", "by": "vimota", "date": "2026-01-30", "stance": "recommend", "quote": "I really like Amla Sandbox addition of injecting tool calls into the sandbox", "excerpt": "Sharing our version of this built on just-bash, AgentFS, and Pyodide: https://github.com/coplane/localsandbox One nice thing about using AgentFS as the VFS is that it's backed by sqlite so it's very portable - making it easy to fork and resume agent workflows across machines / time. I really like Amla Sandbox addition of injecting tool calls into the sandbox, which lets the agent generated code interact with the harn", "context": "", "use_case": "WASM bash shell for agents", "switched_from": "", "story": "Show HN: Amla Sandbox \u2013 WASM bash shell sandbox for AI agents"}]}], "caveats": [], "who": [], "tags": [], "use_cases": ["wasm bash sandbox for agents", "wasm bash shell for agents"], "compared": [{"slug": "brush", "name": "Brush", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "pyodide", "name": "Pyodide", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [{"id": 749269408, "item_id": 46829338, "url": "https://news.ycombinator.com/item?id=46829338", "by": "souvik1997", "date": "2026-01-30", "stance": "neutral", "quote": "Yep, we got that sorted.", "excerpt": "Yep, we got that sorted. Thanks for the suggestion! https://pypi.org/project/amla-sandbox/", "context": "", "use_case": "Sandbox for AI agents", "switched_from": "", "story": "Show HN: Amla Sandbox \u2013 WASM bash shell sandbox for AI agents"}, {"id": 749262384, "item_id": 46828899, "url": "https://news.ycombinator.com/item?id=46828899", "by": "vimota", "date": "2026-01-30", "stance": "neutral", "quote": "", "excerpt": "Thanks for taking a look and the feedback! We run the shim with internet access (https://github.com/coplane/localsandbox/blob/main/localsandbox/shim/deno.json#L7) but the pyodide sandbox itself doesn't run with internet access : https://github.com/coplane/localsandbox/blob/main/localsandbox/shim/src/python.ts#L139", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Amla Sandbox \u2013 WASM bash shell sandbox for AI agents"}, {"id": 749219568, "item_id": 46826223, "url": "https://news.ycombinator.com/item?id=46826223", "by": "souvik1997", "date": "2026-01-30", "stance": "recommend", "quote": "We cheated a bit; we didn't compile the GNU coreutils to wasm. Instead, we have Rust reimplementations of common shell commands.", "excerpt": "Great question. We cheated a bit; we didn't compile the GNU coreutils to wasm. Instead, we have Rust reimplementations of common shell commands. It allows us to focus on the use cases agents actually care about instead of reimplementing all of the corner cases exactly. For `jq` specifically we use the excellent `jaq_interpret` crate: https://crates.io/crates/jaq-interpret curl is interesting. We don't include it curr", "context": "builds Amla Sandbox", "use_case": "WASM shell sandbox for agents", "switched_from": "", "story": "Show HN: Amla Sandbox \u2013 WASM bash shell sandbox for AI agents"}], "threads": [{"url": "https://news.ycombinator.com/item?id=46824877", "title": "Show HN: Amla Sandbox \u2013 WASM bash shell sandbox for AI agents", "mentions": 8}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {"compare": 1, "recommend": 3}, "2026-02": {}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {}, "2026-07": {}, "2026-08": {}, "2026-09": {}, "2026-10": {}}, "quotes": [{"id": 749298256, "item_id": 46831141, "url": "https://news.ycombinator.com/item?id=46831141", "by": "thepoet", "date": "2026-01-30", "stance": "recommend", "quote": "This looks cool, congratulations.", "excerpt": "This looks cool, congratulations. We investigated WASM for our use case but then turned to Apple containers which run 1:1 mapped to a microVM for local use here, which is being used by a bunch of folks https://github.com/instavm/coderunner We are currently also building a solution InstaVM which is ideologically the same but for cloud https://instavm.io", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Amla Sandbox \u2013 WASM bash shell sandbox for AI agents"}, {"id": 749240832, "item_id": 46827552, "url": "https://news.ycombinator.com/item?id=46827552", "by": "rellfy", "date": "2026-01-30", "stance": "recommend", "quote": "I really like the capability enforcement model, it's a great concept.", "excerpt": "I really like the capability enforcement model, it's a great concept. One thing this discussion is missing though is the ecosystem layer. Sandboxing solves execution safety, but there's a parallel problem: how do agents discover and compose tools portably across frameworks? Right now every framework has its own tool format and registry (or none at all). WASM's component model actually solves this \u2014 you get typed inte", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Amla Sandbox \u2013 WASM bash shell sandbox for AI agents"}, {"id": 749236224, "item_id": 46827264, "url": "https://news.ycombinator.com/item?id=46827264", "by": "simonw", "date": "2026-01-30", "stance": "recommend", "quote": "This project looks very cool", "excerpt": "This project looks very cool - I've been trying to build something similar in a few different ways (https://github.com/simonw/denobox is my most recent attempt) but this is way ahead of where I've got, especially given its support for shell scripting. I'm sad about this bit though: > Python code is MIT. The WASM binary is proprietary\u2014you can use it with this package but can't extract or redistribute it separately.", "context": "", "use_case": "WASM bash sandbox for agents", "switched_from": "", "story": "Show HN: Amla Sandbox \u2013 WASM bash shell sandbox for AI agents"}, {"id": 749221296, "item_id": 46826331, "url": "https://news.ycombinator.com/item?id=46826331", "by": "vimota", "date": "2026-01-30", "stance": "recommend", "quote": "I really like Amla Sandbox addition of injecting tool calls into the sandbox", "excerpt": "Sharing our version of this built on just-bash, AgentFS, and Pyodide: https://github.com/coplane/localsandbox One nice thing about using AgentFS as the VFS is that it's backed by sqlite so it's very portable - making it easy to fork and resume agent workflows across machines / time. I really like Amla Sandbox addition of injecting tool calls into the sandbox, which lets the agent generated code interact with the harn", "context": "", "use_case": "WASM bash shell for agents", "switched_from": "", "story": "Show HN: Amla Sandbox \u2013 WASM bash shell sandbox for AI agents"}, {"id": 749217232, "item_id": 46826077, "url": "https://news.ycombinator.com/item?id=46826077", "by": "sd2k", "date": "2026-01-30", "stance": "compare", "quote": "with what seem to be some different tradeoffs", "excerpt": "Cool to see more projects in this space! I think Wasm is a great way to do secure sandboxing here. How does Amla handle commands like grep/jq/curl etc which make AI agents so effective at bash but require recompilation to WASI (which is kinda impractical for so many projects)? I've been working on a couple of things which take a very similar approach, with what seem to be some different tradeoffs: - eryx [1], which u", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Amla Sandbox \u2013 WASM bash shell sandbox for AI agents"}]}