multikernel/sandlock

The lightest AI sandbox. A process-based sandbox for Linux, no container, no VM, no privilege, no prompt injection

What it solves

Sandlock provides a lightweight, high-performance way to sandbox untrusted code on Linux without the overhead of containers or virtual machines. It is designed to secure applications—such as AI agents or scripts—by restricting their access to the filesystem, network, and system calls without requiring root privileges or complex image builds.

How it works

Sandlock uses modern Linux kernel features, specifically Landlock (for filesystem and network access control) and seccomp-bpf (for system call filtering). It also utilizes seccomp user notifications to enforce resource limits and virtualize parts of the system. Because it does not rely on cgroups or namespaces, it achieves near-instant startup times (around 5ms) and minimal performance overhead compared to traditional container runtimes.

Who it’s for

This project is for developers building AI agents, automation tools, or any application that needs to execute untrusted code safely. It is particularly useful for those who need fine-grained control over what an agent can access (e.g., specific HTTP endpoints or directories) without the complexity of managing Docker containers.

Highlights

  • Rootless Operation: Runs without root privileges, cgroups, or container runtimes.
  • Granular Control: Supports HTTP-level access control lists (ACLs) and specific network/filesystem path rules.
  • Copy-on-Write (COW) Filesystem: Automatically protects your working directory by capturing changes, which can be committed or discarded.
  • Low Overhead: Significantly faster startup and lower latency than Docker or MicroVMs.
  • Multi-Language Support: Provides native Rust libraries, a CLI, and SDKs for Python and Go.

Related

  • Project
    superradcompany/microsandbox

    A tool for running untrusted workloads in fast, local microVMs with hardware-level isolation, specifically designed for AI agents and automated code execution.

  • Project
    akitaonrails/ai-jail

    A CLI that runs AI coding agents in an OS sandbox (bubblewrap/Landlock/seccomp on Linux, sandbox-exec on macOS), scoped to prevent accidents — not to stop attackers. The project directory is read-write; the host is hidden by default, with opt-in flags for credentials, network, GPU, display, etc. Includes a strict `--lockdown` mode and a "phantom credential" proxy that keeps real API keys out of the sandbox. A mature, well-documented Rust project — not a list, tutorial, or demo.

  • Project
    getkern/kern

    A daemonless, rootless container runtime designed to securely execute AI-generated code and agent tool calls in isolated, kernel-enforced environments.

  • Project
    clawkwork/clawk

    A tool that provides disposable Linux VMs for AI coding agents, allowing them to run with full autonomy in a secure, isolated environment separate from the host machine.

  • Project
    anthropics/sandbox-runtime

    Anthropic Sandbox Runtime (srt) is a cross‑platform tool that uses native OS sandboxing (sandbox‑exec, bubblewrap, Windows Filtering Platform) to run arbitrary commands with strict filesystem and network restrictions. Designed for AI agents and MCP servers, it offers a CLI (`srt`) and a TypeScript library, supports dynamic config updates, per‑command allow lists, and real‑time violation reporting.