Landlock · seccomp-bpf · seccomp notify

Run Untrusted Code Without Handing It Your Machine

Sandlock is a lightweight Linux process sandbox. Kernel-enforced policy over filesystem, network, syscalls, and resources, applied in about 5 milliseconds. No root, no image, no container runtime, no hypervisor.

Get Started View on GitHub

Confine a Python agent

# Read-only system dirs, one writable dir, 512 MB cap,
# and exactly one host reachable on exactly one port.
$ sandlock run -r /usr -r /lib -r /etc -w /tmp \
    -m 512M -P 20 -t 300 \
    --net-allow api.openai.com:443 \
    -- python3 agent.py

5 ms Startup overhead 44× faster to start than Docker

0 Privileges required No root, no setuid, no daemon

97% Of bare-metal throughput Measured on Redis SET and GET

Open source, Apache-2.0, written in Rust

The gap

Strict Confinement Without the Weight

Containers and microVMs package and boot a system. To run one command you do not trust, they make you pay for a system anyway.

Containers

An image, a daemon, and root or user namespaces, for a boundary that is a namespace rather than a policy.

~200 ms to start

Image build in the loop

No HTTP-level control

MicroVMs

A separate kernel is a strong boundary, but it needs KVM, a guest image, and gives no view of what runs inside.

Requires KVM access

Guest image to maintain

Block-level filesystem only

Sandlock

A policy applied to a process: the kernel enforces the rules, a small supervisor handles the rest.

~5 ms to start, no image

Runs as an ordinary user

Method + host + path ACL

Capabilities

One Policy, Six Enforcement Surfaces

One policy object, whether written as CLI flags, a TOML profile, or a struct in Python, Rust, or Go.

Filesystem

Landlock read and write grants, evaluated by the kernel on every access, immune to TOCTOU races.

Network

Default-deny egress. Allow a host, IP, or CIDR on specific ports over TCP, UDP, or ICMP.

HTTP ACL

Allow POST api.openai.com/v1/chat/completions and nothing else, with zero-config HTTPS interception.

Credential injection

The key is attached in the proxy after the ACL check. The sandboxed process never holds it.

Copy-on-write

Writes are staged, then committed or discarded. --dry-run shows what a command would change.

Resources

Memory, processes, open files, CPU, disk, and GPU device selection, without cgroups.

How it works

Kernel First, Supervisor Second

Confinement is installed in the child before it executes anything. What the kernel can enforce, the kernel enforces.

Landlock

Kernel-evaluated access control for paths, TCP ports, and IPC, irreversible for the life of the process tree.

seccomp-bpf

A default blocklist removes syscall families a confined workload has no business using.

seccomp notify

The supervisor sees selected syscalls first: IP checks, memory accounting, COW, /proc virtualization.

Read the architecture

Programmable

A Sandbox You Can Program, Not Just Configure

Handlers run your code inside the supervisor, on any syscall you choose, and decide what the workload observes.

Deny, or fabricate a result. Return an errno, or a value the syscall never produced.

Serve files that do not exist. Hand the guest a sealed in-memory file with no host path.

Audit that cannot be evaded. Interception sits below the runtime, so raw syscalls do not route around it.

Read the handler API

Audit every open, from your own code

import sandlock
from sandlock.handler import Handler, NotifAction

class Audit(Handler):
    def handle(self, ctx):
        print(f"open {ctx.read_path()} from pid {ctx.pid}")
        return NotifAction.continue_()

sb = sandlock.Sandbox(fs_readable=["/usr", "/lib", "/etc"])
sb.run_with_handlers(
    cmd=["python3", "task.py"],
    handlers=[("openat", Audit())],
)

Performance

Confinement You Can Leave On

Landlock and the seccomp blocklist cost nothing per syscall. Only syscalls the supervisor registers for take a round trip.

Workload	Bare metal	Sandlock	Docker
`/bin/echo` startup	2 ms	7 ms	307 ms
Redis SET, 100K ops	82K rps	80K rps	52K rps
Redis GET, 100K ops	79K rps	77K rps	53K rps
Redis p99 latency	0.5 ms	0.6 ms	1.5 ms
COW fork × 1000	No equivalent	530 ms	No equivalent