Sandlock Documentation
Everything needed to write, test, and ship a Sandlock policy: a five-minute quickstart, guides for each enforcement surface, one page per interface, and a complete field reference.
Sandlock confines a Linux process using Landlock for filesystem, network, and IPC rules, seccomp-bpf for syscall filtering, and seccomp user notification for the decisions that have to be made while the workload runs. It needs no root, no image build, no container runtime, and no hypervisor.
$ sandlock run -w /tmp -r /usr -r /lib -m 512M -- python3 untrusted.pyStart here
Getting Started
Check your kernel, build from source, and run your first confined command. Five minutes.
Architecture
The confinement sequence, what each layer enforces, and which syscalls reach the supervisor.
Policy guides
Each guide covers one enforcement surface end to end: what the kernel does, what the supervisor does, and how to express the rules from the CLI or an SDK.
Filesystem and COW
Read, write, and deny rules; chroot and per-sandbox mounts; copy-on-write commit, abort, and dry-run.
Network Model
The full rule grammar for allowlists and denylists, protocol gating, bind ports, and port virtualization.
HTTP ACL and Credentials
Method, host, and path rules; zero-config HTTPS interception; injecting a secret the workload never sees.
Resource Limits
Memory, processes, open files, CPU throttling and pinning, disk quota, and GPU device selection, all without cgroups.
Determinism
Frozen time via vDSO patching, a seeded PRNG for getrandom, sorted directory reads, and disabled ASLR.
Kernel Protections
What each Landlock protection stops, which kernel provides it, and how to relax one for an older host without doing it silently.
Dynamic Policy
Inspect syscall events at runtime, return a verdict, and tighten the sandbox while it runs.
Extension Handlers
Run your own code inside the supervisor on any syscall: deny it, fake its return value, inject synthetic file content, or defer slow work off the loop.
Profiles and learn
Reusable TOML profiles, and generating one automatically by observing a real run of your workload.
Interfaces
One Rust core behind every surface. A policy written for one interface means exactly the same thing in all of them.
CLI Reference
Every subcommand and flag: run, ps, inspect, kill, check, learn, profile.
Python SDK
The Sandbox dataclass, pipelines, dry-run, COW fork and reduce, and policy callbacks.
Rust API
The typed builder, async execution, protection posture, and custom seccomp-notify handlers.
Go SDK
cgo bindings over the C ABI, build modes, and the configuration struct.
OCI Runtime
Using Sandlock as a low-level runtime under containerd, CRI-O, and Kubernetes.
MCP Server
Sandboxed shell, Python, and file tools for Claude Desktop, Cursor, and other MCP clients.
Reference
Requirements at a glance
| Requirement | Version | Needed for |
|---|---|---|
| Linux | 6.12+ | Landlock ABI v6, the strict default posture |
| Rust | 1.70+ | Building from source |
| Python | 3.8+ | The Python SDK and MCP server (optional) |
| Root | Not required | Nothing |
| cgroups | Not required | Nothing |
Older kernels. Sandlock refuses to start by default when a protection it expects is unavailable. Individual protections can be degraded or disabled per policy so a sandbox can run on a kernel below 6.12. See Kernel Protections.
Getting help
Bugs, feature requests, and questions belong in GitHub issues. Suspected sandbox escapes should go privately to contact@multikernel.io first; see the security model for what counts. Teams running sandboxes across a fleet rather than a machine can read about the HTTP API and scheduler.