sbxFeatured

sbx

2026OngoingDeveloper Tools
View Code

Overview

sbx is a single-binary Rust CLI for sandboxed Docker development environments. Pick a flavor (npm, bun, rust, java, claude, ...), run sbx init in a project, then sbx shell or sbx run to drop into a container with your repo bind-mounted at the same path it has on the host. Each project runs isolated with only what it needs (no host home, SSH agent, docker socket, or host network unless you opt in), so a compromised dependency or AI agent can't reach your SSH keys, cloud credentials, or other projects on disk. Outbound traffic can be gated through an allow-listed host-proxy, public exposure goes through a Cloudflare tunnel, and TLS terminates in a sidecar so per-project secrets stay per-project. Dynamic shell completions via clap_complete.

RustDockerCLISecurityDevOps

My Role

Author

Key Features

Per-flavor sandbox images (npm, bun, rust, java, claude, ...)
Repo bind-mounted at the same path as on the host
No host home, SSH agent, docker socket, or network by default
Opt-in network access and declared mounts
Allow-listed host-proxy for outbound traffic
Cloudflare tunnel for public exposure
TLS sidecar for per-project secrets
Dynamic shell completions via clap_complete

Challenges Solved

Isolating each project so dependencies and agents can't read host secrets
Gating outbound traffic through an allow-listed host-proxy
Exposing sandboxes publicly through a Cloudflare tunnel
Terminating TLS in a sidecar to keep per-project secrets per-project

Tech Stack

Backend

Rustclapclap_complete

Tools & Services

DockerCloudflare Tunnelhost-proxy