hsh logo - whisper face emoji in watercolor and ink

hsh

hsh (pronounced hush) is a developer focused Linux container sandbox to keep the agents under your care from chatting with systems you don't want them to using a MitM proxy HTTPS proxy with secret injection and containerized filesystem access.

To use an analogy: hsh is the exam proctor keeping the room quiet so your little agents don't cheat.

Install

Install hsh

curl -fsSL https://raw.githubusercontent.com/philips/hsh/main/install.sh | sh

Overview

The goals of hsh isolation include:

  • Single install binary
  • Rootless Linux containers
  • VM-like isolation with gVisor
  • Dynamic egress network isolation
  • Fast permission review/approval workflow
  • Simple OCI (docker) agent packaging

The goal is to make it easy to hack on software alongside an agent harness like

pi, codex, claude-code, etc while protecting you from moderate dangers of

agent credential exfiltration to the open internet OR local filesystem damage.

Newsletter

Signup for news and release information. No spam.

README | GitHub