Install

Protect your repo during builds

Run a build with network access but writes confined to ./dist:

zerobox --allow-write=./dist --allow-net -- npm run build

Run tests with no network and catch accidental external calls:

zerobox --allow-write=/tmp -- npm test

Quick start

Run a command with no writes and no network access:

zerobox -- node -e "console.log('hello')"

Allow writes to a specific directory:

zerobox --allow-write=. -- node script.js

Allow network to a specific domain:

zerobox --allow-net=api.openai.com -- node agent.js

Pass a secret to a specific host and the inner process never sees the real value:

zerobox --secret OPENAI_API_KEY=sk-proj-123 --secret-host OPENAI_API_KEY=api.openai.com -- node agent.js

Record filesystem changes and undo them after execution:

zerobox --restore --allow-write=. -- npm install

Or record without restoring, then inspect and undo later:

zerobox --snapshot --allow-write=. -- npm install
zerobox snapshot list
zerobox snapshot diff <session-id>
zerobox snapshot restore <session-id>

For programmatic usage jump to the SDK that matches your stack:

• Rust SDK
• TypeScript SDK
• Python SDK

Examples

Environment variables

By default only essential variables are passed to the sandbox, e.g. PATH, HOME, USER, SHELL, TERM, LANG.

Inherit all parent env vars:

zerobox --allow-env -- node app.js

Inherit specific env vars only:

zerobox --allow-env=PATH,HOME,DATABASE_URL -- node app.js

Block specific env vars:

zerobox --allow-env --deny-env=AWS_SECRET_ACCESS_KEY -- node app.js

Or set explicit variables:

zerobox --env NODE_ENV=production --env DEBUG=false -- node app.js

CLI reference

SDKs