yagop/sandbox

Sandbox-proxy solves a specific problem: how do you let code run in an isolated container and still let it authenticate to services like GitHub or npm, without ever letting that code see your real access tokens. It works by routing all of a sandbox's web traffic through a small proxy program written in Go with no outside dependencies. The proxy holds the real tokens and slips them into outgoing requests only as they leave the network, on their way to trusted destinations like github.com or the npm registry. The code running inside the sandbox never has the token in its own environment, so even if that code were compromised, it could only use the token against the specific destinations you have allowed, not read or steal the token itself. Everything is driven through a single shell script that gives you a sandbox command. Running sandbox proxy up starts one shared proxy that any number of sandboxed containers can use at once. From inside a normal project folder, sandbox run opens a shell in that sandbox, or you can run a specific command like sandbox run npm ci directly. Tokens like a GitHub token are picked up automatically from tools you are already logged into, or from a command you configure, and are resolved fresh each time the proxy starts so they never sit around in your shell. By default the proxy allows outgoing connections to any host and only injects credentials into the ones you configure, though it can be locked down to a strict allow list of destinations. It intercepts encrypted web traffic using a certificate it generates the first time it runs, which the sandbox is set up to trust. Non web traffic, like raw database connections, can either bypass the proxy entirely or be forced through it depending on a setting. The project also includes a helper for tunneling other network services, such as a database on the local network, through the same proxy. This is a security tool aimed at developers who want to give an AI agent or automated tool sandboxed access to their accounts without handing over the actual credentials.