Drop: a sandbox for day-to-day dev work with gVisor support

[wrr]

Hi all, I would like to share a project that recently added gVisor integration.

github.com/wrr/drop is a high-level rootless sandbox with a workflow inspired by Python's virtualenv, which lets you easily create and enter isolated environments. Unlike with Docker/Podman, with Drop you don't build a container image from scratch, instead, you keep working within your existing distro. Drop rearranges the filesystem to give you an isolated, disposable home dir with selected files and dirs from your original home exposed in most cases as read-only.

Similarly to Docker/Podman, Drop added support for runtime selection. The native runtime uses Linux namespaces alone for isolation. The gvisor runtime, in addition to namespaces, runs the program under gVisor.

Since adding the support, I'm using the gVisor runtime daily for my development work, which also includes running Claude Code, and it works well and is stable.

Drop has a pretty extensive set of end-to-end tests. All of them were switched to exercise both runtimes, and almost all pass with gVisor. The only issues discovered are related to pseudoterminal reporting and to runsc not supporting a mix of pseudoterminal and non-pseudoterminal file descriptors, but this second issue is minor.

Thanks!

[EtiennePerot]

Curious about the network part. runsc doesn't yet support rootless networking, though we are working on adding support via passt which I see this is using. Did you already plumb it through, or does it only work in the non-gVisor case?

cc @nybidari

[wrr]

Thanks for taking a look! Before starting runsc Drop sets up a network namespace with passt/pasta. This is done within a user namespace, so it is rootless. Then, runsc is started with --network=host flag. So the gVisor path does use pasta for network isolation, but it is host-provided networking, not gVisor networking.

[EtiennePerot]

Nice. Hope this can switch to non-gVisor-host networking when possible. cc @nybidari @carzh