Not a runtime the workload runs inside: a policy the kernel applies to a process between fork() and exec(), so it never executes an unconfined instruction.
As much policy as possible goes into the kernel. Only rules it cannot express, such as a destination IP or an HTTP path, reach the supervisor.
Linux's unprivileged access-control LSM. The policy's filesystem, network, and IPC rules become a Landlock ruleset applied to the child; the kernel evaluates every access against it, and it can never be relaxed for the life of the process tree. It costs nothing per syscall beyond the kernel's own check.
PATH_BENEATH rules, resolved by the kernel at access time, so immune to TOCTOU races.A filter removes syscall families a confined workload has no legitimate use for. The default blocklist is always applied; a policy can add denials or re-enable named groups such as System V IPC. Installed with NO_NEW_PRIVS and inherited by every descendant, the same filter also carries the notification listener for layer 3.
A no-supervisor mode uses layers 1 and 2 alone, which is how one sandlock nests inside another.
"Connect only to this IP", "stop at 512 MB", "stage this write" all need a decision at the moment the syscall happens. Seccomp user notification hands those syscalls to an async supervisor in the parent. Its responsibilities are narrow and its ordering fixed: built-in handlers run first, custom ones after, so a handler can extend confinement but never subvert it.
Every restriction is in place before the workload's first instruction, and the parent supervises only after the child confirms the filter is installed.
fork()setpgid(0,0)chdir(cwd), if the policy sets oneNO_NEW_PRIVSa setuid binary can now confer nothingLandlock ruleset appliedfilesystem, network, and IPCseccomp filter installeddeny list plus the notification listener, whose descriptor goes to the parentexec(cmd)the workload's first instruction, already confinedEverything on the left happens before the workload exists. Everything on the right supervises it once it does.
Why fds are closed at step 7. A descriptor inherited from the parent was opened before confinement, so the kernel honours it. Closing everything above stderr removes that escape hatch.
Only these syscalls are intercepted, and only when the matching policy feature is active. Everything else runs at full speed.
| Syscall | What the supervisor does |
|---|---|
clone / fork / vfork | Enforces the concurrent process count |
mmap / munmap / brk / mremap | Tracks the memory limit |
connect / sendto / sendmsg | Destination IP allowlist, on-behalf execution, HTTP ACL redirect |
bind | On-behalf bind and port remapping |
openat | /proc virtualization and COW interception |
unlinkat / mkdirat / renameat2 | COW write interception |
execve / execveat | Policy callback hold and vDSO re-patching |
getrandom | Deterministic PRNG injection |
clock_nanosleep / timer_settime | Timer adjustment when time is frozen |
getdents64 | PID filtering and COW directory merging |
getsockname | Port remap translation |
Sandlock picks the cheapest path that can express your rules. Nothing to configure; it falls out of the policy.
For pure TCP port rules with no host, IP, CIDR, or HTTP ACL. Landlock enforces the allowlist in the kernel; no per-syscall overhead.
--net-allow :443For any host, IP, CIDR, UDP, ICMP, or HTTP rule, since the destination must be inspected. The supervisor duplicates the child's socket, checks the destination, and performs the syscall itself.
--net-allow api.example.com:443One Rust core. Every interface drives it through the same policy object.
The CLI and SDKs go through the C ABI. sandlock-oci links the core directly, being a Rust crate itself.
| Component | Role |
|---|---|
sandlock-core | Rust library: Landlock, seccomp, supervisor, COW, pipelines |
sandlock-cli | The sandlock binary |
sandlock-oci | OCI runtime shim for containerd, CRI-O, and Kubernetes |
sandlock-ffi | C ABI shared library, libsandlock_ffi.so |
| Python SDK | ctypes bindings over the FFI library, plus an MCP server |
| Go SDK | cgo bindings over the FFI library |
This architecture is described in full, with measurements, in the paper and the engineering posts.
“Sandlock is a lightweight Linux process sandbox organized around a simple split: static, input-independent policy is compiled into kernel-enforced rules, while a narrow supervisor handles runtime-dependent decisions and virtualized effects. This split lets Sandlock enforce filesystem, network, IPC, and syscall policies without root, cgroups, images, or mandatory namespaces.”
Linux 6.12 or later, where Landlock ABI v6 lands. Individual protections can be waived per policy for a mixed fleet.
| Capability | Minimum kernel |
|---|---|
| seccomp user notification | 5.6 |
| Landlock filesystem rules | 5.13 |
| Landlock TCP port rules (ABI v4) | 6.7 |
| Landlock IPC scoping (ABI v6) | 6.12 |
sandlock check reports the kernel's Landlock ABI and available protections. Building needs Rust 1.70; the Python SDK needs Python 3.8.
Every field, flag, and enforcement rule, from a five-minute quickstart to the full reference.