{"slug": "gondolin", "name": "Gondolin", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 6, "commenters": 12, "warners": 4, "score": 1.608, "rising": 0.69, "first": "2026-02-08", "latest": "2026-09-30", "why": "Sandbox: `https://github.com/earendil-works/gondolin`", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 6, "neutral": 3, "compare": 1, "warn": 3}, "spark": [0, 0, 0, 2, 0, 1, 0, 0, 1, 0, 2, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "Sandbox: `https://github.com/earendil-works/gondolin`", "kind": "", "icon": true, "domain": null, "github_repo": "github.com/earendil-works/gondolin", "official_url": "https://github.com/earendil-works/gondolin", "pricing": "", "aliases": ["Gondolin", "gondolin"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 798568897, "item_id": 49910556, "url": "https://news.ycombinator.com/item?id=49910556", "by": "mmulqueen", "date": "2026-09-30", "stance": "recommend", "quote": "Heavily inspired by Gondolin", "excerpt": "I had a similar thought a couple of months ago. I did some work to fully sandbox the agent - from the rest of my computer, from my user data, from other projects and from the world at large. I now find myself doing a lot on auto, I do a thorough human edit and review and then I squash. If it gets it wrong, I can throw the changes away and rebuild the sandbox. Having a good plan, good automated QA and all the other th", "context": "", "use_case": "", "switched_from": "", "story": "Dots: Always-on agents"}, {"id": 796562273, "item_id": 49785142, "url": "https://news.ycombinator.com/item?id=49785142", "by": "Vax-", "date": "2026-09-21", "stance": "recommend", "quote": "Sandbox: `https://github.com/earendil-works/gondolin`", "excerpt": "Everything you want to add can be made as an extension, and pi has many ready extension to be added. For example, Sandbox: `https://github.com/earendil-works/gondolin` The sandbox extension is at https://github.com/earendil-works/pi/tree/main/packages/coding-agent/examples/extensions/gondolin And the extension at `https://github.com/earendil-works/pi/tree/main/packages/coding-agent/examples/extensions/gondolin` Which", "context": "", "use_case": "sandbox extension", "switched_from": "", "story": "AX \u2013 Google\u2019s Open Agentic Orchestrator"}, {"id": 782310224, "item_id": 48894389, "url": "https://news.ycombinator.com/item?id=48894389", "by": "jboss10", "date": "2026-07-13", "stance": "recommend", "quote": "Gondolin[1] is what you are describing.", "excerpt": "Gondolin[1] is what you are describing. It's made by the same person who made the Pi coding agent and sends all of the agent's bash into a small QEMU vm. [1](https://earendil-works.github.io/gondolin/", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Clawk \u2013 Give coding agents a disposable Linux VM, not your laptop"}, {"id": 765767232, "item_id": 47860452, "url": "https://news.ycombinator.com/item?id=47860452", "by": "thewisenerd", "date": "2026-04-22", "stance": "recommend", "quote": "inspired by gondolin which does the same", "excerpt": "we recently moved to a similar approach, inspired by gondolin which does the same: https://earendil-works.github.io/gondolin/secrets/ an 'mitm' tls proxy also gives you much better firewalling capabilities [1], not that firewalls aren't inherently leaky, codex's a 'wildcard' based one [2]; hence \"easy\" to bypass [3] github's list is slightly better [4] but ymmv [1] than a rudimentary \"allow based on nslookup $host\" w", "context": "", "use_case": "Secret injection proxy", "switched_from": "", "story": "Some secret management belongs in your HTTP proxy"}, {"id": 754140864, "item_id": 47133804, "url": "https://news.ycombinator.com/item?id=47133804", "by": "NamlchakKhandro", "date": "2026-02-23", "stance": "recommend", "quote": "Or what the https://github.com/earendil-works/gondolin is doing", "excerpt": "this won't solve the problem. Instead you need to do what hardsnow is doing: https://news.ycombinator.com/item?id=47133573 Or what the https://github.com/earendil-works/gondolin is doing", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: enveil \u2013 hide your .env secrets from prAIng eyes"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 788011776, "item_id": 49250736, "url": "https://news.ycombinator.com/item?id=49250736", "by": "olejorgenb", "date": "2026-08-10", "stance": "warn", "quote": "I'd say it's not ready for prime time yet unfortunately", "excerpt": "I'd say it's not ready for prime time yet unfortunately: https://github.com/earendil-works/gondolin/issues/115", "context": "", "use_case": "Isolated microVM sandboxes", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 787879088, "item_id": 49242443, "url": "https://news.ycombinator.com/item?id=49242443", "by": "codethief", "date": "2026-08-10", "stance": "warn", "quote": "In my experience it's mostly the UX/DX where Gondolin is lacking.", "excerpt": "In my experience it's mostly the UX/DX where Gondolin is lacking. For instance, I don't want to set up a JavaScript project every single time I need a sandbox. Instead, I just want to place a config file somewhere in my repo or my home dir and be done with it. So I wrote a wrapper around Gondolin which allows me to do that and a few other things: https://github.com/codethief/tuor (Warning: Still very much experimenta", "context": "", "use_case": "", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 787854368, "item_id": 49240898, "url": "https://news.ycombinator.com/item?id=49240898", "by": "rusch", "date": "2026-08-10", "stance": "warn", "quote": "is not what i'm looking for", "excerpt": "Yes, the stated \"target workload\"[0] is not what i'm looking for. I want my agent to run for long, spin up dedicated local stack while developing etc. It seems with gondoling i need to explain the agent to run commands in the sandbox, but then where does the agent run itself? [0]: https://earendil-works.github.io/gondolin/workloads/", "context": "", "use_case": "", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}]}], "who": [], "tags": [], "use_cases": ["sandbox extension", "isolated microvm sandboxes", "agent sandboxing", "secret injection proxy", "micro-vm agent sandbox"], "compared": [{"slug": "pi", "name": "Pi", "co": 3, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=49239751", "title": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents", "mentions": 5}, {"url": "https://news.ycombinator.com/item?id=49896604", "title": "Dots: Always-on agents", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49780797", "title": "AX \u2013 Google\u2019s Open Agentic Orchestrator", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48892859", "title": "Show HN: Clawk \u2013 Give coding agents a disposable Linux VM, not your laptop", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47825888", "title": "Some secret management belongs in your HTTP proxy", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47808268", "title": "Show HN: Smol machines \u2013 subsecond coldstart, portable virtual machines", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {}, "2026-02": {"neutral": 2, "recommend": 2}, "2026-03": {}, "2026-04": {"neutral": 1, "recommend": 1}, "2026-05": {}, "2026-06": {}, "2026-07": {"recommend": 1}, "2026-08": {"compare": 1, "warn": 3}, "2026-09": {"recommend": 2}, "2026-10": {}}, "quotes": [{"id": 798568897, "item_id": 49910556, "url": "https://news.ycombinator.com/item?id=49910556", "by": "mmulqueen", "date": "2026-09-30", "stance": "recommend", "quote": "Heavily inspired by Gondolin", "excerpt": "I had a similar thought a couple of months ago. I did some work to fully sandbox the agent - from the rest of my computer, from my user data, from other projects and from the world at large. I now find myself doing a lot on auto, I do a thorough human edit and review and then I squash. If it gets it wrong, I can throw the changes away and rebuild the sandbox. Having a good plan, good automated QA and all the other th", "context": "", "use_case": "", "switched_from": "", "story": "Dots: Always-on agents"}, {"id": 796562273, "item_id": 49785142, "url": "https://news.ycombinator.com/item?id=49785142", "by": "Vax-", "date": "2026-09-21", "stance": "recommend", "quote": "Sandbox: `https://github.com/earendil-works/gondolin`", "excerpt": "Everything you want to add can be made as an extension, and pi has many ready extension to be added. For example, Sandbox: `https://github.com/earendil-works/gondolin` The sandbox extension is at https://github.com/earendil-works/pi/tree/main/packages/coding-agent/examples/extensions/gondolin And the extension at `https://github.com/earendil-works/pi/tree/main/packages/coding-agent/examples/extensions/gondolin` Which", "context": "", "use_case": "sandbox extension", "switched_from": "", "story": "AX \u2013 Google\u2019s Open Agentic Orchestrator"}, {"id": 788011776, "item_id": 49250736, "url": "https://news.ycombinator.com/item?id=49250736", "by": "olejorgenb", "date": "2026-08-10", "stance": "warn", "quote": "I'd say it's not ready for prime time yet unfortunately", "excerpt": "I'd say it's not ready for prime time yet unfortunately: https://github.com/earendil-works/gondolin/issues/115", "context": "", "use_case": "Isolated microVM sandboxes", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 787901776, "item_id": 49243861, "url": "https://news.ycombinator.com/item?id=49243861", "by": "dbmikus", "date": "2026-08-10", "stance": "warn", "quote": "", "excerpt": "If you'd be open to trying something else, my startup is open core: https://github.com/gofixpoint/amika The definition for your cloud sandboxes is just a TOML config in your repo We also have an API and CLI to let users message the agent from outside or across sandboxes We're still building a lot, so if you have any time to try it out (amika.dev) and give feedback, that is worth gold to us!", "context": "", "use_case": "", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 787879088, "item_id": 49242443, "url": "https://news.ycombinator.com/item?id=49242443", "by": "codethief", "date": "2026-08-10", "stance": "warn", "quote": "In my experience it's mostly the UX/DX where Gondolin is lacking.", "excerpt": "In my experience it's mostly the UX/DX where Gondolin is lacking. For instance, I don't want to set up a JavaScript project every single time I need a sandbox. Instead, I just want to place a config file somewhere in my repo or my home dir and be done with it. So I wrote a wrapper around Gondolin which allows me to do that and a few other things: https://github.com/codethief/tuor (Warning: Still very much experimenta", "context": "", "use_case": "", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 787854368, "item_id": 49240898, "url": "https://news.ycombinator.com/item?id=49240898", "by": "rusch", "date": "2026-08-10", "stance": "warn", "quote": "is not what i'm looking for", "excerpt": "Yes, the stated \"target workload\"[0] is not what i'm looking for. I want my agent to run for long, spin up dedicated local stack while developing etc. It seems with gondoling i need to explain the agent to run commands in the sandbox, but then where does the agent run itself? [0]: https://earendil-works.github.io/gondolin/workloads/", "context": "", "use_case": "", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 787848722, "item_id": 49240545, "url": "https://news.ycombinator.com/item?id=49240545", "by": "rusch", "date": "2026-08-10", "stance": "compare", "quote": "Closest open source I have seen is https://earendil-works.github.io/gondolin but the DX is not as polished.", "excerpt": "The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders. I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in. Closest open source I have seen is https://earendil-works.github.io/gondol", "context": "", "use_case": "agent sandboxing", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 782310224, "item_id": 48894389, "url": "https://news.ycombinator.com/item?id=48894389", "by": "jboss10", "date": "2026-07-13", "stance": "recommend", "quote": "Gondolin[1] is what you are describing.", "excerpt": "Gondolin[1] is what you are describing. It's made by the same person who made the Pi coding agent and sends all of the agent's bash into a small QEMU vm. [1](https://earendil-works.github.io/gondolin/", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Clawk \u2013 Give coding agents a disposable Linux VM, not your laptop"}, {"id": 765767232, "item_id": 47860452, "url": "https://news.ycombinator.com/item?id=47860452", "by": "thewisenerd", "date": "2026-04-22", "stance": "recommend", "quote": "inspired by gondolin which does the same", "excerpt": "we recently moved to a similar approach, inspired by gondolin which does the same: https://earendil-works.github.io/gondolin/secrets/ an 'mitm' tls proxy also gives you much better firewalling capabilities [1], not that firewalls aren't inherently leaky, codex's a 'wildcard' based one [2]; hence \"easy\" to bypass [3] github's list is slightly better [4] but ymmv [1] than a rudimentary \"allow based on nslookup $host\" w", "context": "", "use_case": "Secret injection proxy", "switched_from": "", "story": "Some secret management belongs in your HTTP proxy"}, {"id": 764986448, "item_id": 47811653, "url": "https://news.ycombinator.com/item?id=47811653", "by": "dimitry12", "date": "2026-04-17", "stance": "neutral", "quote": "is another project addressing a similar use-case", "excerpt": "https://github.com/earendil-works/gondolin is another project addressing a similar use-case.", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Smol machines \u2013 subsecond coldstart, portable virtual machines"}, {"id": 754469699, "item_id": 47154356, "url": "https://news.ycombinator.com/item?id=47154356", "by": "CuriouslyC", "date": "2026-02-25", "stance": "neutral", "quote": "Gondolin is the default on MacOS", "excerpt": "I created Smith to provide a claw style system designed around secure multi-user deployments. Smith has prompt injection mitigation techniques built in, and provides a policy gated tool gateway and uses Postgres row level security to isolate user/agent interactions. Smith also comes with some significant usability improvements: Postgres based session storage that the agent can query with full-text search. This enable", "context": "", "use_case": "", "switched_from": "", "story": "Smith: The Secure Open Source Multi-User AI Assistant Framework"}, {"id": 754320128, "item_id": 47145008, "url": "https://news.ycombinator.com/item?id=47145008", "by": "fjk", "date": "2026-02-24", "stance": "neutral", "quote": "I\u2019ve been tinkering with Gondolin", "excerpt": "I\u2019ve been tinkering with Gondolin, a micro-vm agent sandbox. Here\u2019s an example config: https://github.com/earendil-works/gondolin/blob/main/host/examples/pi-gondolin.ts", "context": "", "use_case": "micro-VM agent sandbox", "switched_from": "", "story": "Pi \u2013 a minimal terminal coding harness"}, {"id": 754140864, "item_id": 47133804, "url": "https://news.ycombinator.com/item?id=47133804", "by": "NamlchakKhandro", "date": "2026-02-23", "stance": "recommend", "quote": "Or what the https://github.com/earendil-works/gondolin is doing", "excerpt": "this won't solve the problem. Instead you need to do what hardsnow is doing: https://news.ycombinator.com/item?id=47133573 Or what the https://github.com/earendil-works/gondolin is doing", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: enveil \u2013 hide your .env secrets from prAIng eyes"}, {"id": 752981120, "item_id": 47061320, "url": "https://news.ycombinator.com/item?id=47061320", "by": "codethief", "date": "2026-02-18", "stance": "recommend", "quote": "something like Armin Rohnacher's new sandboxing solution[0]", "excerpt": "So like\u2026 a container or a VM? > if it tried I would get a popup Ok, that's not implemented yet but using a custom FUSE-based file system (or using something like Armin Rohnacher's new sandboxing solution[0]) it shouldn't be too hard. I bet you could ask Claude to write that. :) [0]: https://github.com/earendil-works/gondolin", "context": "", "use_case": "", "switched_from": "", "story": "Claude Sonnet 4.6 System Card"}, {"id": 751008240, "item_id": 46938015, "url": "https://news.ycombinator.com/item?id=46938015", "by": "CuriouslyC", "date": "2026-02-08", "stance": "neutral", "quote": "Armin Ronacher is working on Gondolin", "excerpt": "There are a lot of options in this space. Armin Ronacher is working on Gondolin (https://github.com/earendil-works/gondolin) for example. I built agentd as a layer in front of this stuff so you can expose secure shell capabilities over the network as a tool rather than baking it into the harness, or running the harness in that environment.", "context": "", "use_case": "", "switched_from": "", "story": "Matchlock: Linux-based sandboxing for AI agents"}]}