superradcompany/microsandbox

I can recommend microsandbox. More mature than smolmachines. I have tried both. https://github.com/superradcompany/microsandbox

microsandbox is open-source and runs on linux, macos and windows: https://github.com/superradcompany/microsandbox/

There's also microsandbox which has similar features: https://github.com/superradcompany/microsandbox (Not affiliated with them, just tried it out last week.)

Agreed. Network control and secret injection together with a microVM setup is as good as it gets right now, although I believe that we need more fine-grained tools down the road. It sounds like Microsandbox would be the perfect fit for what you are describing. I also built my own coding agent workbench on top of it ( https://github.com/isolade/isolade ). Microsandbox is quite cool, check it out: https://github.com/superradcompany/microsandbox

…already have installed inside the sandbox. The downside is getting all the policies correct as it seems every project needs some new type of access, though Nono does try to make policy writing easy. I've been considering switching my approach to using a microVM through microsandbox[3]. The pro of this approach is you can essentially skip the policies and rely on the security of the VM boundary. The negative is that now you've lost all your installed tools, so you need to either provision at runtime or build something (like an image) beforehand to match your dev environment. I still don't know which is less maintenance. And while I think herde is pretty well thought out, I do think about so…