{"slug": "nono", "name": "nono", "category": "security", "category_name": "Security and passwords", "description": "Sandboxing tool that restricts the filesystem, network and command access of AI coding agents.", "recommenders": 5, "commenters": 9, "warners": 1, "score": 4.517, "rising": 1.69, "first": "2026-05-08", "latest": "2026-10-21", "why": "Used to sandbox AI coding agents so they can safely run in YOLO or permission-skipping mode, with policy-based blocking, proxy credential injection and rollbacks.", "why_is_quote": false, "has_verdict": true, "sentiment": {"recommend": 7, "neutral": 3, "compare": 1, "warn": 1}, "spark": [0, 0, 0, 0, 0, 0, 1, 1, 2, 2, 0, 1], "listed": true, "loved": ["Safe YOLO mode", "Action blocking"], "caveat": "Policy upkeep", "short_quote": "The flexibility of a good nono setup (which is easy because they ship a nono skill that claude can consume) actually locks things down significantly better", "icon": true, "domain": "nono.sh", "github_repo": null, "official_url": "https://nono.sh", "pricing": "unknown", "aliases": ["nono", "Nono", "nono.sh"], "verdict": [{"text": "Used to sandbox AI coding agents so they can safely run in YOLO or permission-skipping mode,", "cites": [{"id": 787903328, "item_id": 49243958, "url": "https://news.ycombinator.com/item?id=49243958", "by": "lemontheme", "date": "2026-08-10", "stance": "recommend", "quote": "Nono has been my daily driver since the start of the year.", "excerpt": "Nono has been my daily driver since the start of the year. It's not a perfect sandbox -- that's for sure. For example, the default network rules let you escape via a global TMUX server. But it is extremely practical. It gives me enough guarantees to feel confident about running in YOLO mode. So far nothing has gone awry.", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 783662560, "item_id": 48978910, "url": "https://news.ycombinator.com/item?id=48978910", "by": "awinter-py", "date": "2026-07-20", "stance": "recommend", "quote": "I use nono.sh for sandboxing", "excerpt": "I use nono.sh for sandboxing -- I think a lot of power users are using sandbox + YOLO mode because approval prompts slow them down yes it's bad if the permission system is broken, but serious users have not trusted this stuff for a while, find the built-in permissions layer burdensome, and are already using a safety layer somewhere else", "context": "power user", "use_case": "sandboxing coding agents", "switched_from": "", "story": "Stop Using OpenCode"}, {"id": 769117024, "item_id": 48069814, "url": "https://news.ycombinator.com/item?id=48069814", "by": "isityettime", "date": "2026-05-08", "stance": "recommend", "quote": "The external sandboxing tool I use (nono) supports rollbacks for this kind of situation.", "excerpt": "The external sandboxing tool I use (nono) supports rollbacks for this kind of situation. But I also only give agents write access to the project I'm asking them to work in, so they can't actually delete more than one codebase even temporarily, inside the sandbox. YOLO modes are useful, and a lot more productive than trying to do one-by-one approvals. But you just need to devise a policy about what your blast radius i", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "So that's why they call it \"YOLO-mode\""}, {"id": 787826385, "item_id": 49239149, "url": "https://news.ycombinator.com/item?id=49239149", "by": "sbysb", "date": "2026-08-09", "stance": "recommend", "quote": "The flexibility of a good nono setup (which is easy because they ship a nono skill that claude can consume) actually locks things down significantly better", "excerpt": "I had another comment in a thread last week about this: https://news.ycombinator.com/item?id=49111625 I really think that using something like Paseo (I use Ouijit[1] because I think it's actually a step ahead of where most of these multiplexers are) and nono[2] is basically the best coverage you can have, and really lets you go crazy with auto mode or permission skipping withiout having to worry about any security co", "context": "", "use_case": "sandboxing agents", "switched_from": "", "story": "OpenChamber: An Agentic Development Environment"}]}, {"text": " with policy-based blocking, proxy credential injection and rollbacks.", "cites": [{"id": 785786000, "item_id": 49111625, "url": "https://news.ycombinator.com/item?id=49111625", "by": "sbysb", "date": "2026-07-30", "stance": "recommend", "quote": "We use nono [1] for this internally, essentially blocking any actions we don't want agents to be able to do without human approval.", "excerpt": "Git worktrees are a great isolation boundary for _changes_ (especially making changes in parallel on a single machine), but not behavior. If you are trying to actually run autonomous agents securely you need something that lives outside the harness that actually blocks actions in a way that can't be prompted around. We use nono [1] for this internally, essentially blocking any actions we don't want agents to be able ", "context": "team running autonomous coding agents", "use_case": "sandboxing coding agents", "switched_from": "", "story": "Git worktrees are not an isolation boundary for coding agents"}, {"id": 802994992, "item_id": 50187187, "url": "https://news.ycombinator.com/item?id=50187187", "by": "isityettime", "date": "2026-10-21", "stance": "recommend", "quote": "For my LLM agents, I use a tool called Nono, whose macOS implementation is built on the same foundation as sandbox-exec.", "excerpt": "> All the sandbox-exec and all the Lulu rules are not going to protect against something like this. No, you can block this with sandboxing tools. For my LLM agents, I use a tool called Nono, whose macOS implementation is built on the same foundation as sandbox-exec. One of the key features it supports (and it's not the only tool that does this) is proxying and the injection of credentials via the proxy. For example, ", "context": "runs Codex at work", "use_case": "sandboxing LLM agents, credential injection", "switched_from": "", "story": "Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor"}, {"id": 769117024, "item_id": 48069814, "url": "https://news.ycombinator.com/item?id=48069814", "by": "isityettime", "date": "2026-05-08", "stance": "recommend", "quote": "The external sandboxing tool I use (nono) supports rollbacks for this kind of situation.", "excerpt": "The external sandboxing tool I use (nono) supports rollbacks for this kind of situation. But I also only give agents write access to the project I'm asking them to work in, so they can't actually delete more than one codebase even temporarily, inside the sandbox. YOLO modes are useful, and a lot more productive than trying to do one-by-one approvals. But you just need to devise a policy about what your blast radius i", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "So that's why they call it \"YOLO-mode\""}]}, {"text": " The most common caveat is that writing per-project policies can be cumbersome,", "cites": [{"id": 793155936, "item_id": 49572246, "url": "https://news.ycombinator.com/item?id=49572246", "by": "softwarewright", "date": "2026-09-05", "stance": "warn", "quote": "I tried nono to limit commands an agent can run but that proved to be cumbersome.", "excerpt": "I tried nono to limit commands an agent can run but that proved to be cumbersome. I ended up creating multiple logins on a Linux system. I used my developer account to clone git repos and then create local bare repos in a read only dir. The new linux user accounts can clone from these bare repos but not push. This way, each coding agent (installed per linux account) can only work within the file system for that user ", "context": "", "use_case": "limiting coding agent commands", "switched_from": "", "story": "Ask HN: How do you gate an autonomous coding agent's shell access?"}, {"id": 774788849, "item_id": 48424303, "url": "https://news.ycombinator.com/item?id=48424303", "by": "jpeeler", "date": "2026-06-06", "stance": "recommend", "quote": "Nono does try to make policy writing easy", "excerpt": "I'm currently using herde[1] to handle/supervise multiple agents (with some patches I need to try to upstream) along with Nono[2] for sandboxing. This sandboxing approach avoids use of a microVM, which lets me use tooling I already have installed inside the sandbox. The downside is getting all the policies correct as it seems every project needs some new type of access, though Nono does try to make policy writing eas", "context": "", "use_case": "agent sandboxing", "switched_from": "", "story": "Ask HN: What is your (AI) dev tech stack / workflow? (June 2026)"}]}, {"text": " and one daily user notes it is not a perfect sandbox.", "cites": [{"id": 787903328, "item_id": 49243958, "url": "https://news.ycombinator.com/item?id=49243958", "by": "lemontheme", "date": "2026-08-10", "stance": "recommend", "quote": "Nono has been my daily driver since the start of the year.", "excerpt": "Nono has been my daily driver since the start of the year. It's not a perfect sandbox -- that's for sure. For example, the default network rules let you escape via a global TMUX server. But it is extremely practical. It gives me enough guarantees to feel confident about running in YOLO mode. So far nothing has gone awry.", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}]}], "praise": [{"label": "Safe YOLO mode", "summary": "Gives commenters enough confidence to run agents without one-by-one approval prompts.", "quotes": [{"id": 787903328, "item_id": 49243958, "url": "https://news.ycombinator.com/item?id=49243958", "by": "lemontheme", "date": "2026-08-10", "stance": "recommend", "quote": "Nono has been my daily driver since the start of the year.", "excerpt": "Nono has been my daily driver since the start of the year. It's not a perfect sandbox -- that's for sure. For example, the default network rules let you escape via a global TMUX server. But it is extremely practical. It gives me enough guarantees to feel confident about running in YOLO mode. So far nothing has gone awry.", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 783662560, "item_id": 48978910, "url": "https://news.ycombinator.com/item?id=48978910", "by": "awinter-py", "date": "2026-07-20", "stance": "recommend", "quote": "I use nono.sh for sandboxing", "excerpt": "I use nono.sh for sandboxing -- I think a lot of power users are using sandbox + YOLO mode because approval prompts slow them down yes it's bad if the permission system is broken, but serious users have not trusted this stuff for a while, find the built-in permissions layer burdensome, and are already using a safety layer somewhere else", "context": "power user", "use_case": "sandboxing coding agents", "switched_from": "", "story": "Stop Using OpenCode"}, {"id": 769117024, "item_id": 48069814, "url": "https://news.ycombinator.com/item?id=48069814", "by": "isityettime", "date": "2026-05-08", "stance": "recommend", "quote": "The external sandboxing tool I use (nono) supports rollbacks for this kind of situation.", "excerpt": "The external sandboxing tool I use (nono) supports rollbacks for this kind of situation. But I also only give agents write access to the project I'm asking them to work in, so they can't actually delete more than one codebase even temporarily, inside the sandbox. YOLO modes are useful, and a lot more productive than trying to do one-by-one approvals. But you just need to devise a policy about what your blast radius i", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "So that's why they call it \"YOLO-mode\""}]}, {"label": "Action blocking", "summary": "Blocks agent actions that can't be prompted around, enforced outside the agent harness.", "quotes": [{"id": 785786000, "item_id": 49111625, "url": "https://news.ycombinator.com/item?id=49111625", "by": "sbysb", "date": "2026-07-30", "stance": "recommend", "quote": "We use nono [1] for this internally, essentially blocking any actions we don't want agents to be able to do without human approval.", "excerpt": "Git worktrees are a great isolation boundary for _changes_ (especially making changes in parallel on a single machine), but not behavior. If you are trying to actually run autonomous agents securely you need something that lives outside the harness that actually blocks actions in a way that can't be prompted around. We use nono [1] for this internally, essentially blocking any actions we don't want agents to be able ", "context": "team running autonomous coding agents", "use_case": "sandboxing coding agents", "switched_from": "", "story": "Git worktrees are not an isolation boundary for coding agents"}, {"id": 787826385, "item_id": 49239149, "url": "https://news.ycombinator.com/item?id=49239149", "by": "sbysb", "date": "2026-08-09", "stance": "recommend", "quote": "The flexibility of a good nono setup (which is easy because they ship a nono skill that claude can consume) actually locks things down significantly better", "excerpt": "I had another comment in a thread last week about this: https://news.ycombinator.com/item?id=49111625 I really think that using something like Paseo (I use Ouijit[1] because I think it's actually a step ahead of where most of these multiplexers are) and nono[2] is basically the best coverage you can have, and really lets you go crazy with auto mode or permission skipping withiout having to worry about any security co", "context": "", "use_case": "sandboxing agents", "switched_from": "", "story": "OpenChamber: An Agentic Development Environment"}]}, {"label": "Easy policies", "summary": "Tries to make policy writing easy and ships a nono skill that Claude can consume.", "quotes": [{"id": 774788849, "item_id": 48424303, "url": "https://news.ycombinator.com/item?id=48424303", "by": "jpeeler", "date": "2026-06-06", "stance": "recommend", "quote": "Nono does try to make policy writing easy", "excerpt": "I'm currently using herde[1] to handle/supervise multiple agents (with some patches I need to try to upstream) along with Nono[2] for sandboxing. This sandboxing approach avoids use of a microVM, which lets me use tooling I already have installed inside the sandbox. The downside is getting all the policies correct as it seems every project needs some new type of access, though Nono does try to make policy writing eas", "context": "", "use_case": "agent sandboxing", "switched_from": "", "story": "Ask HN: What is your (AI) dev tech stack / workflow? (June 2026)"}, {"id": 787826385, "item_id": 49239149, "url": "https://news.ycombinator.com/item?id=49239149", "by": "sbysb", "date": "2026-08-09", "stance": "recommend", "quote": "The flexibility of a good nono setup (which is easy because they ship a nono skill that claude can consume) actually locks things down significantly better", "excerpt": "I had another comment in a thread last week about this: https://news.ycombinator.com/item?id=49111625 I really think that using something like Paseo (I use Ouijit[1] because I think it's actually a step ahead of where most of these multiplexers are) and nono[2] is basically the best coverage you can have, and really lets you go crazy with auto mode or permission skipping withiout having to worry about any security co", "context": "", "use_case": "sandboxing agents", "switched_from": "", "story": "OpenChamber: An Agentic Development Environment"}]}, {"label": "Credential injection", "summary": "Its proxy injects real API credentials so the agent only sees dummy ones.", "quotes": [{"id": 802994992, "item_id": 50187187, "url": "https://news.ycombinator.com/item?id=50187187", "by": "isityettime", "date": "2026-10-21", "stance": "recommend", "quote": "For my LLM agents, I use a tool called Nono, whose macOS implementation is built on the same foundation as sandbox-exec.", "excerpt": "> All the sandbox-exec and all the Lulu rules are not going to protect against something like this. No, you can block this with sandboxing tools. For my LLM agents, I use a tool called Nono, whose macOS implementation is built on the same foundation as sandbox-exec. One of the key features it supports (and it's not the only tool that does this) is proxying and the injection of credentials via the proxy. For example, ", "context": "runs Codex at work", "use_case": "sandboxing LLM agents, credential injection", "switched_from": "", "story": "Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor"}]}, {"label": "Rollbacks", "summary": "Supports rolling back destructive changes an agent makes.", "quotes": [{"id": 769117024, "item_id": 48069814, "url": "https://news.ycombinator.com/item?id=48069814", "by": "isityettime", "date": "2026-05-08", "stance": "recommend", "quote": "The external sandboxing tool I use (nono) supports rollbacks for this kind of situation.", "excerpt": "The external sandboxing tool I use (nono) supports rollbacks for this kind of situation. But I also only give agents write access to the project I'm asking them to work in, so they can't actually delete more than one codebase even temporarily, inside the sandbox. YOLO modes are useful, and a lot more productive than trying to do one-by-one approvals. But you just need to devise a policy about what your blast radius i", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "So that's why they call it \"YOLO-mode\""}]}, {"label": "No microVM", "summary": "Avoids a microVM, so already-installed tooling works inside the sandbox.", "quotes": [{"id": 774788849, "item_id": 48424303, "url": "https://news.ycombinator.com/item?id=48424303", "by": "jpeeler", "date": "2026-06-06", "stance": "recommend", "quote": "Nono does try to make policy writing easy", "excerpt": "I'm currently using herde[1] to handle/supervise multiple agents (with some patches I need to try to upstream) along with Nono[2] for sandboxing. This sandboxing approach avoids use of a microVM, which lets me use tooling I already have installed inside the sandbox. The downside is getting all the policies correct as it seems every project needs some new type of access, though Nono does try to make policy writing eas", "context": "", "use_case": "agent sandboxing", "switched_from": "", "story": "Ask HN: What is your (AI) dev tech stack / workflow? (June 2026)"}]}], "caveats": [{"label": "Policy upkeep", "summary": "Every project seems to need new access rules, and one user found limiting commands cumbersome.", "quotes": [{"id": 774788849, "item_id": 48424303, "url": "https://news.ycombinator.com/item?id=48424303", "by": "jpeeler", "date": "2026-06-06", "stance": "recommend", "quote": "Nono does try to make policy writing easy", "excerpt": "I'm currently using herde[1] to handle/supervise multiple agents (with some patches I need to try to upstream) along with Nono[2] for sandboxing. This sandboxing approach avoids use of a microVM, which lets me use tooling I already have installed inside the sandbox. The downside is getting all the policies correct as it seems every project needs some new type of access, though Nono does try to make policy writing eas", "context": "", "use_case": "agent sandboxing", "switched_from": "", "story": "Ask HN: What is your (AI) dev tech stack / workflow? (June 2026)"}, {"id": 793155936, "item_id": 49572246, "url": "https://news.ycombinator.com/item?id=49572246", "by": "softwarewright", "date": "2026-09-05", "stance": "warn", "quote": "I tried nono to limit commands an agent can run but that proved to be cumbersome.", "excerpt": "I tried nono to limit commands an agent can run but that proved to be cumbersome. I ended up creating multiple logins on a Linux system. I used my developer account to clone git repos and then create local bare repos in a read only dir. The new linux user accounts can clone from these bare repos but not push. This way, each coding agent (installed per linux account) can only work within the file system for that user ", "context": "", "use_case": "limiting coding agent commands", "switched_from": "", "story": "Ask HN: How do you gate an autonomous coding agent's shell access?"}, {"id": 777811298, "item_id": 48613206, "url": "https://news.ycombinator.com/item?id=48613206", "by": "quinncom", "date": "2026-06-20", "stance": "neutral", "quote": "I use Pi inside nono.sh sandbox", "excerpt": "I just got it working with Pi, it works great. I use Pi inside nono.sh sandbox, which requires setting: export PLANNOTATOR_REMOTE=1 Then adding to the nono profile: { \"filesystem\": { \"allow\": [ \"~/.plannotator\" ], }, \u201cnetwork\": { \u201copen_port\": [0], \"listen_port\": [19432] }, \"open_urls\": { \"allow_localhost\": true } }", "context": "", "use_case": "sandboxing coding agent", "switched_from": "", "story": "Show HN: Plannotator \u2013 annotate agent plans, diffs, and HTML"}]}, {"label": "Imperfect isolation", "summary": "Default network rules allow escape via a global tmux server.", "quotes": [{"id": 787903328, "item_id": 49243958, "url": "https://news.ycombinator.com/item?id=49243958", "by": "lemontheme", "date": "2026-08-10", "stance": "recommend", "quote": "Nono has been my daily driver since the start of the year.", "excerpt": "Nono has been my daily driver since the start of the year. It's not a perfect sandbox -- that's for sure. For example, the default network rules let you escape via a global TMUX server. But it is extremely practical. It gives me enough guarantees to feel confident about running in YOLO mode. So far nothing has gone awry.", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}]}], "who": [{"by": "isityettime", "context": "runs Codex at work", "url": "https://news.ycombinator.com/item?id=50187187", "date": "2026-10-21"}, {"by": "sbysb", "context": "team running autonomous coding agents", "url": "https://news.ycombinator.com/item?id=49111625", "date": "2026-07-30"}, {"by": "awinter-py", "context": "power user", "url": "https://news.ycombinator.com/item?id=48978910", "date": "2026-07-20"}], "tags": ["for AI coding agents", "for teams", "for Claude Code users", "for macOS users"], "use_cases": ["sandboxing agents", "sandboxing coding agents", "sandboxing ai agents", "sandboxing llm agents, credential injection", "limiting coding agent commands", "sandboxing coding agent"], "compared": [], "makers": [{"id": 753065200, "item_id": 47066575, "url": "https://news.ycombinator.com/item?id=47066575", "by": "decodebytes", "date": "2026-02-18", "stance": "recommend", "quote": "I wanted to introduce a project I have building for the past few weeks", "excerpt": "Hey HN Luke here. I wanted to introduce a project I have building for the past few weeks in response to events such as openclaw and the glaring security issues at hand. Prior to nono, I created Sigstore , a project used for software supply chain security now used by pypi, npm, brew and GitHub for release attestation and provence. The problem: Protecting the host from the agent is largely solved, microVMs (kata, firec", "context": "creator of Sigstore", "use_case": "kernel-enforced sandbox for AI agents", "switched_from": "", "story": "Kernel-enforced sandbox App and SDK for AI agents, MCP and LLM workloads"}], "threads": [{"url": "https://news.ycombinator.com/item?id=50181114", "title": "Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49556858", "title": "Ask HN: How do you gate an autonomous coding agent's shell access?", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49239751", "title": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49233448", "title": "OpenChamber: An Agentic Development Environment", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49214994", "title": "Claude Code: Starting August 14, auto mode will be the default permission mode", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49110389", "title": "Git worktrees are not an isolation boundary for coding agents", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {}, "2026-02": {}, "2026-03": {}, "2026-04": {}, "2026-05": {"recommend": 1}, "2026-06": {"recommend": 1, "compare": 1, "neutral": 1}, "2026-07": {"neutral": 1, "recommend": 2}, "2026-08": {"neutral": 1, "recommend": 2}, "2026-09": {"warn": 1}, "2026-10": {"recommend": 1}}, "quotes": [{"id": 802994992, "item_id": 50187187, "url": "https://news.ycombinator.com/item?id=50187187", "by": "isityettime", "date": "2026-10-21", "stance": "recommend", "quote": "For my LLM agents, I use a tool called Nono, whose macOS implementation is built on the same foundation as sandbox-exec.", "excerpt": "> All the sandbox-exec and all the Lulu rules are not going to protect against something like this. No, you can block this with sandboxing tools. For my LLM agents, I use a tool called Nono, whose macOS implementation is built on the same foundation as sandbox-exec. One of the key features it supports (and it's not the only tool that does this) is proxying and the injection of credentials via the proxy. For example, ", "context": "runs Codex at work", "use_case": "sandboxing LLM agents, credential injection", "switched_from": "", "story": "Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor"}, {"id": 793155936, "item_id": 49572246, "url": "https://news.ycombinator.com/item?id=49572246", "by": "softwarewright", "date": "2026-09-05", "stance": "warn", "quote": "I tried nono to limit commands an agent can run but that proved to be cumbersome.", "excerpt": "I tried nono to limit commands an agent can run but that proved to be cumbersome. I ended up creating multiple logins on a Linux system. I used my developer account to clone git repos and then create local bare repos in a read only dir. The new linux user accounts can clone from these bare repos but not push. This way, each coding agent (installed per linux account) can only work within the file system for that user ", "context": "", "use_case": "limiting coding agent commands", "switched_from": "", "story": "Ask HN: How do you gate an autonomous coding agent's shell access?"}, {"id": 787903328, "item_id": 49243958, "url": "https://news.ycombinator.com/item?id=49243958", "by": "lemontheme", "date": "2026-08-10", "stance": "recommend", "quote": "Nono has been my daily driver since the start of the year.", "excerpt": "Nono has been my daily driver since the start of the year. It's not a perfect sandbox -- that's for sure. For example, the default network rules let you escape via a global TMUX server. But it is extremely practical. It gives me enough guarantees to feel confident about running in YOLO mode. So far nothing has gone awry.", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 787826385, "item_id": 49239149, "url": "https://news.ycombinator.com/item?id=49239149", "by": "sbysb", "date": "2026-08-09", "stance": "recommend", "quote": "The flexibility of a good nono setup (which is easy because they ship a nono skill that claude can consume) actually locks things down significantly better", "excerpt": "I had another comment in a thread last week about this: https://news.ycombinator.com/item?id=49111625 I really think that using something like Paseo (I use Ouijit[1] because I think it's actually a step ahead of where most of these multiplexers are) and nono[2] is basically the best coverage you can have, and really lets you go crazy with auto mode or permission skipping withiout having to worry about any security co", "context": "", "use_case": "sandboxing agents", "switched_from": "", "story": "OpenChamber: An Agentic Development Environment"}, {"id": 787484659, "item_id": 49217791, "url": "https://news.ycombinator.com/item?id=49217791", "by": "abound", "date": "2026-08-07", "stance": "neutral", "quote": "I'll be sandboxing agents (with tools like nono, smolmachines, etc) going forward", "excerpt": "I don't disagree with anything you said here, but I find auto-mode is too permissive on the reading side of things. I used Claude this morning to convert the financial books for my nonprofit from some export of a proprietary software (Aplos) to plaintext accounting (Beancount), and was surprised to find it had found my personal Beancount ledger elsewhere on my hard drive and modelled its plan on that. That was correc", "context": "", "use_case": "sandboxing agents", "switched_from": "", "story": "Claude Code: Starting August 14, auto mode will be the default permission mode"}, {"id": 785786000, "item_id": 49111625, "url": "https://news.ycombinator.com/item?id=49111625", "by": "sbysb", "date": "2026-07-30", "stance": "recommend", "quote": "We use nono [1] for this internally, essentially blocking any actions we don't want agents to be able to do without human approval.", "excerpt": "Git worktrees are a great isolation boundary for _changes_ (especially making changes in parallel on a single machine), but not behavior. If you are trying to actually run autonomous agents securely you need something that lives outside the harness that actually blocks actions in a way that can't be prompted around. We use nono [1] for this internally, essentially blocking any actions we don't want agents to be able ", "context": "team running autonomous coding agents", "use_case": "sandboxing coding agents", "switched_from": "", "story": "Git worktrees are not an isolation boundary for coding agents"}, {"id": 783662560, "item_id": 48978910, "url": "https://news.ycombinator.com/item?id=48978910", "by": "awinter-py", "date": "2026-07-20", "stance": "recommend", "quote": "I use nono.sh for sandboxing", "excerpt": "I use nono.sh for sandboxing -- I think a lot of power users are using sandbox + YOLO mode because approval prompts slow them down yes it's bad if the permission system is broken, but serious users have not trusted this stuff for a while, find the built-in permissions layer burdensome, and are already using a safety layer somewhere else", "context": "power user", "use_case": "sandboxing coding agents", "switched_from": "", "story": "Stop Using OpenCode"}, {"id": 781254405, "item_id": 48828400, "url": "https://news.ycombinator.com/item?id=48828400", "by": "lemontheme", "date": "2026-07-07", "stance": "neutral", "quote": "inside nono (sandbox)", "excerpt": "If you do most of your work on a central server and treat your other devices as thin clients, then (afaik) Tmux/Zellij are the way to go \u2013 not to mention if you want to multiplayer with colleagues. (I know Wezterm has remote session multiplexing in beta, but I\u2019d be surprised if you can re-attach from a different machine.) Lately I\u2019ve been experimenting with embracing the total scriptability of my favorite terminal, K", "context": "", "use_case": "sandboxing agents", "switched_from": "", "story": "Herdr: One terminal to rule them all"}, {"id": 777811298, "item_id": 48613206, "url": "https://news.ycombinator.com/item?id=48613206", "by": "quinncom", "date": "2026-06-20", "stance": "neutral", "quote": "I use Pi inside nono.sh sandbox", "excerpt": "I just got it working with Pi, it works great. I use Pi inside nono.sh sandbox, which requires setting: export PLANNOTATOR_REMOTE=1 Then adding to the nono profile: { \"filesystem\": { \"allow\": [ \"~/.plannotator\" ], }, \u201cnetwork\": { \u201copen_port\": [0], \"listen_port\": [19432] }, \"open_urls\": { \"allow_localhost\": true } }", "context": "", "use_case": "sandboxing coding agent", "switched_from": "", "story": "Show HN: Plannotator \u2013 annotate agent plans, diffs, and HTML"}, {"id": 774954449, "item_id": 48434653, "url": "https://news.ycombinator.com/item?id=48434653", "by": "mathstuf", "date": "2026-06-07", "stance": "compare", "quote": "but also have seen nono: https://github.com/always-further/nono", "excerpt": "There are a number of utilities for this. I use jai: https://jai.scs.stanford.edu/ but also have seen nono: https://github.com/always-further/nono smolvm: https://github.com/smol-machines/smolvm zerobox https://github.com/afshinm/zerobox and matchlock https://github.com/jingkaihe/matchlock They all have pros and cons. Pick the one that suits you best. Then you're also agent harness flexible (I use opencode).", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Anthropic, please ship an official Claude Desktop for Linux"}, {"id": 774788849, "item_id": 48424303, "url": "https://news.ycombinator.com/item?id=48424303", "by": "jpeeler", "date": "2026-06-06", "stance": "recommend", "quote": "Nono does try to make policy writing easy", "excerpt": "I'm currently using herde[1] to handle/supervise multiple agents (with some patches I need to try to upstream) along with Nono[2] for sandboxing. This sandboxing approach avoids use of a microVM, which lets me use tooling I already have installed inside the sandbox. The downside is getting all the policies correct as it seems every project needs some new type of access, though Nono does try to make policy writing eas", "context": "", "use_case": "agent sandboxing", "switched_from": "", "story": "Ask HN: What is your (AI) dev tech stack / workflow? (June 2026)"}, {"id": 769117024, "item_id": 48069814, "url": "https://news.ycombinator.com/item?id=48069814", "by": "isityettime", "date": "2026-05-08", "stance": "recommend", "quote": "The external sandboxing tool I use (nono) supports rollbacks for this kind of situation.", "excerpt": "The external sandboxing tool I use (nono) supports rollbacks for this kind of situation. But I also only give agents write access to the project I'm asking them to work in, so they can't actually delete more than one codebase even temporarily, inside the sandbox. YOLO modes are useful, and a lot more productive than trying to do one-by-one approvals. But you just need to devise a policy about what your blast radius i", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "So that's why they call it \"YOLO-mode\""}]}