multikernel/sandlock

What it solves

Sandlock provides a lightweight process sandbox for Linux that allows users to run untrusted code without requiring root privileges, cgroups, or heavy container images. It fills the gap between unrestricted execution and heavy VMs/containers by offering strict confinement of the filesystem, network, and system calls with very low startup overhead (~5ms).

How it works

Sandlock is written in Rust and uses a combination of Linux kernel features to enforce isolation:

• Landlock: Used for filesystem, network, and IPC scoping.
• seccomp-bpf: Used for system call filtering.
• seccomp user notification: A supervisor process (built with Tokio) intercepts specific syscalls to enforce resource limits (memory, process count), virtualize /proc, and implement a Copy-on-Write (COW) filesystem.
• Transparent Proxy: Handles HTTP-level ACLs, including method, host, and path rules, and can inject credentials or CA certificates into HTTPS traffic.

Who it’s for

• Developers running untrusted code or third-party scripts.
• AI agent developers who need to execute generated code (e.g., the XOA pattern) with restricted data access and no network.
• Users who want to isolate processes with deterministic execution (frozen time and seeded randomness).

Highlights

• No Root Required: Operates entirely in user space without needing root or /etc/subuid configuration.
• Granular Network Control: Supports IP/CIDR allowlists/denylists, port-specific rules, and HTTP-level ACLs.
• Resource Limits: Enforces memory and process limits via seccomp notifications.
• COW Filesystem: Automatically protects working directories by capturing writes in an upper directory.
• Programmable Policy: A policy_fn allows for dynamic, runtime adjustment of permissions based on syscall events.
• Multi-language Support: Provides a CLI, Rust library, and SDKs for Python and Go.