Zouuup/landrun

Health v2 · maintenance only

Adoption not part of the score

2274 stars · 54 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Landrun is a lightweight CLI tool that sandboxes arbitrary Linux processes using the kernel's Landlock security module, with no root privileges or containers required. It provides fine-grained filesystem, TCP network, IPC, and UNIX socket access controls via simple command-line flags.

Use cases

• run untrusted commands in a sandbox without root
• restrict a program's filesystem access to specific directories
• block network access for a CLI tool
• sandbox a build or test command with read-only source and writable output
• limit TCP bind/connect permissions of a process
• give per-command security isolation without containers or SELinux configs

When to choose

• you want lightweight, kernel-native sandboxing on Linux 5.13+
• you need unprivileged sandboxing without Docker, SELinux, or AppArmor setup
• you want simple, auditable per-command access rules

When to avoid

• you need sandboxing on macOS, Windows, or kernels older than 5.13
• you need full container-style isolation with namespaces, cgroups, or seccomp
• you need GUI sandboxing profiles comparable to firejail's application profiles

Facets

cli-tool · maturity active

security security developer-tools cli landlock sandboxing kernel-security firejail-alternative process-isolation no-root sandbox command-line linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Zouuup/landrun")