multikernel/sandlock

The lightest AI sandbox. A process-based sandbox for Linux, no container, no VM, no privilege, no prompt injection

What it solves

Sandlock is a lightweight process sandbox for Linux that provides strict confinement for untrusted code without requiring root privileges, cgroups, or container images. It fills the gap between heavy virtual machines/containers and completely unprotected execution, allowing users to run programs with precise control over filesystem access, network connectivity, and system resources.

How it works

Sandlock is written in Rust and uses a combination of Linux kernel features to enforce security boundaries:

  • Landlock: Used for filesystem, network, and IPC isolation.
  • seccomp-bpf: Used for syscall filtering.
  • seccomp user notification: Allows a supervisor process to intercept and handle specific syscalls in real-time to enforce resource limits, virtualize /proc, and implement a Copy-on-Write (COW) filesystem.
  • COW Filesystem: Intercepts writes to a working directory and stages them in an upper directory, ensuring the original files are protected until changes are committed.
  • Transparent Proxy: Implements HTTP-level ACLs (method, host, and path) and can inject credentials or CA certificates into HTTPS traffic.

Who it’s for

  • Developers needing to run untrusted code (e.g., AI agents or third-party scripts) safely.
  • Users who want fast startup times (~5ms) compared to containers or MicroVMs.
  • System administrators who need to confine processes without managing complex container runtimes or root access.

Highlights

  • No Root Required: Operates entirely without root privileges or cgroups.
  • Granular Network Control: Supports IP allowlists/denylists, port-specific rules, and HTTP-level ACLs.
  • Resource Limits: Enforces memory and process count limits via seccomp notifications.
  • Dynamic Policy: Features a policy_fn that allows inspecting syscall events at runtime to adjust permissions on the fly.
  • Flexible Integration: Provides a CLI, a Rust library, and SDKs for Python and Go.
  • OCI Compatibility: Includes an OCI runtime shim for use with containerd, CRI-O, and Kubernetes.