The archive · Developer & Business Tools · Product decision · 2020–2026
Treeverse's Tilde bet: every AI agent run should commit or roll back atomically
lakeFS maker Treeverse launches tilde.run, a managed agent sandbox with a versioned filesystem; Show HN drew 205 points and 133 comments in May 2026.
Treeverse
What the business is
tilde.run is a managed sandbox for AI agents: it mounts GitHub repositories, S3 buckets and Google Drive folders into one POSIX ~/sandbox, runs the agent in an isolated container with default-deny egress policy, then commits or discards the entire run atomically using lakeFS snapshots.
How it started
Treeverse has built lakeFS, an open-source versioning layer over object storage that has run petabyte-scale data lakes since 2020. Teams running agents against production data kept hitting the same gap: container sandboxes are ephemeral, and local btrfs/ZFS snapshots don't cover S3, GitHub or Google Drive. In 2026 Treeverse launched tilde.run as a second product to make an entire agent run reversible.
What happened
A Tilde run has three phases: compose ~/sandbox from code, data and document sources; execute in an isolated container; then approve-and-commit or roll-back-and-discard. Each run writes to a lakeFS branch, so commits are atomic with object-level conflict detection. Network policy defaults to deny cloud-metadata endpoints such as 169.254.169.254 and logs every outbound call. The 2026-05-06 Show HN thread drew 205 points and 133 comments, praising the rollback model while criticizing the closed-source, SaaS-only posture versus open competitors like smol machines and microsandbox.
How it ended up
As of 2026-05-08 tilde.run was in a free private preview with a CLI, Python SDK and MCP support; pricing was planned as consumption-based. It remained closed-source SaaS, and the review and HN thread both flagged self-hosting as the open question for a product that sits at the trust boundary of agent systems.
Background
tilde.run is a managed sandbox product from Treeverse, the team behind the open-source lakeFS data-versioning engine. It composes GitHub repositories, S3 buckets and Google Drive folders into a single versioned POSIX filesystem inside a sandbox, so an AI agent works against real data sources while every change stays reversible.
The bet is that agent safety should come from versioning, not isolation alone. Containers give you throwaway environments but no durable state, and local snapshot tools can't roll back changes made to remote S3, GitHub or Drive. Treeverse reused lakeFS, which has provided atomic, branched, conflict-detecting versioning over object storage since 2020, and wrapped it in an agent runner.
A Tilde run composes the workspace, executes in an isolated container with default-deny egress policy and a full audit log, then atomically commits the run to a hidden branch — or discards it entirely. Cloud-metadata endpoints like 169.254.169.254 are blocked by default, targeting the prompt-injection exfiltration class. Its Show HN on 2026-05-06 drew 205 points and 133 comments.
As of 2026-05-08 tilde.run was a free private-preview SaaS with CLI, Python SDK and MCP support, and consumption-based pricing planned. The loudest criticism in the thread was that a sandbox — the trust boundary of agent systems — should not be closed source while open alternatives such as smol machines and microsandbox mature.
What has to be true
- Container sandboxes are ephemeral and local snapshots can't cover S3, GitHub or Drive, leaving no rollback for agents that touch production data (DEV review).
- lakeFS already does atomic, branched, conflict-checked versioning at petabyte scale since 2020, giving the rollback engine production miles (DEV review).
- Default-deny egress with audit logging blocks cloud-metadata exfiltration, a real prompt-injection attack class (DEV review).
- Persistence plus rollback answers the thread's top request: an agent's files survive across runs, and any state can be discarded (DEV review, HN comments).
- The 2026-05-06 Show HN drew 133 comments, evidence of real demand in a category that sees a new entrant almost weekly (Hacker News).
What can be applied
When a category's failure mode is irreversible damage, make the unit of trust a transaction: give agents git-style semantics — commit or roll back — reusing versioning you already run in production.
Aftermath
As of 2026-05-08 tilde.run was in free private preview: install via one curl command, with a CLI, Python SDK and MCP support, and consumption-based pricing planned but unannounced. The product remained closed-source SaaS, and reviewers noted that as sandboxes become the trust boundary of agent systems, a self-hosted or open-core option would likely become table stakes — the same open-core path lakeFS itself took.
Sources
- Show HN: Tilde.run – Agent sandbox with a transactional, versioned filesystem
- Tilde.run Review: Versioned Filesystem for AI Agents
spotted an error? The archive wants to know.
Your turn
You just read one. Describe what you are building, and see who is betting on the same thing.
Free account · 3 free questions · no card