As everyone mention, there are a lot of implementations of this idea, and not only for agent workflows.

My own approach has the following features, hopefully that gets stolen into an actual softawre package at some point:

- Generate bwrap options (for use in bwrap or gVisor) rather than build the sandbox itself. I wont't trust a random sandbox.

- UDS based automatic HTTP proxy with popup or allowlist and reverse proxy to serve apps. (I won't trust any more net access).

- File based configuration (executable with shebang).

- Composable profiles and command line options for ad-hoc sandboxes.

- Manage system directories (use host's, use another distro's, use an OCI image, etc.) as well as home directory for the sandbox and how the "work" directory is shared.

Drop appears to do a few similar things, and it seems to fit well with how I use such systems. I would like to see more details about how the sandboxes are executed and about the security model.