https://github.com/smol-machines/smolvm
SDKs available https://github.com/smol-machines/smol","title":null,"type":"comment","url":null}],"created_at":"2026-07-12T21:17:48.000Z","created_at_i":1783891068,"id":48884907,"options":[],"parent_id":48884885,"points":null,"story_id":48884885,"text":"I use a bunch of different coding agents but they always have annoying permission pop-ups or not the right kind of sandboxing. I wanted something simple and flexible so I made it over the weekend.
You use it like so:
- Get the binary in whichever way you like (you can use Nix, Mise or just get it through the releases page).
- Configure via `.agent-run/config.toml` to make the folders you care about read-write, and add any environment variables.
- Run your agent like so: `agent-run <pi|claude|codex|opencode>`.
It's very generic so technically you can use this for any command.
Currently only supports Linux because I don't have access to a macOS machine and sandbox-exec looks daunting.","title":null,"type":"comment","url":null},{"author":"devdoc83","children":[],"created_at":"2026-07-13T15:38:46.000Z","created_at_i":1783957126,"id":48894355,"options":[],"parent_id":48884885,"points":null,"story_id":48884885,"text":"The folder read-write config is the right primitive \u2014 that's what actually contains an agent when it goes off-script. And +1 on sandbox-exec being the daunting part; the macOS story is the hard bit.","title":null,"type":"comment","url":null}],"created_at":"2026-07-12T21:15:56.000Z","created_at_i":1783890956,"id":48884885,"options":[],"parent_id":null,"points":8,"story_id":48884885,"text":null,"title":"Show HN: Agent-run \u2013 Run a coding agent in a sandboxed environment","type":"story","url":"https://github.com/sin-ack/agent-run"}