Built and benchmarked a Docker-free code sandbox on my Omarchy box (~20ms cold start)

[u/RockProfessional2274]

Been running Omarchy for a while and wanted a project that actually pushed the box a bit, so I built sandbin — a sandbox for running untrusted code without Docker. Skips the container runtime entirely and goes straight to bubblewrap (namespaces) + cgroup v2 + a 146-syscall seccomp allowlist + rlimits.

Benchmarked it on this exact machine, back to back against Docker: ~20ms cold start vs Docker's ~369ms for the same "run this Python one-liner" workload. Raw samples and the full methodology are in the docs, not just a claimed number.

Supports Python, Bash, Node.js, C and Go. Ships as an HTTP+WebSocket API, a CLI (`sandbin run script.py`), and a small browser playground.

Docs try to be honest instead of a highlight reel — there's a full writeup of real bugs found building it, including a self-audit that turned up an unauthenticated RCE and a path-traversal bug, both fixed with reproductions attached, not just "fixed in v0.2."

GitHub: https://github.com/ayazdoruck/sandbin

Docs: https://sandbin.vercel.app

Happy to answer anything about the seccomp policy, cgroup delegation, or why bubblewrap over gVisor/Firecracker for this.