# Zouuup/landrun

Run any Linux process in a secure, unprivileged sandbox using Landlock. Think firejail, but lightweight, user-friendly, and baked into the kernel.

Repository: https://github.com/Zouuup/landrun
Canonical: https://ross.abutalabs.com/products/landrun
Language: Go
License: MIT
License Family: permissive
Topics: cli, golang, kernel, landlock, sandbox, sandbox-environment, security, security-tools
Last push: 2026-07-23T12:23:09+00:00

## Health v2 (maintenance only)
Score: 83/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 94, release rhythm 94, longevity 37
- inputs: {"age_days": 530, "days_push": 41, "days_rel": 42, "gap_med": 0, "n_releases_24m": 10}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2274, forks 54 (observed 2026-08-28T04:06:33.310878+00:00)

## What it is
Landrun is a lightweight CLI tool that sandboxes arbitrary Linux processes using the kernel's Landlock security module, with no root privileges or containers required. It provides fine-grained filesystem, TCP network, IPC, and UNIX socket access controls via simple command-line flags.

## Use cases
- run untrusted commands in a sandbox without root
- restrict a program's filesystem access to specific directories
- block network access for a CLI tool
- sandbox a build or test command with read-only source and writable output
- limit TCP bind/connect permissions of a process
- give per-command security isolation without containers or SELinux configs

## When to choose
- you want lightweight, kernel-native sandboxing on Linux 5.13+
- you need unprivileged sandboxing without Docker, SELinux, or AppArmor setup
- you want simple, auditable per-command access rules

## When to avoid
- you need sandboxing on macOS, Windows, or kernels older than 5.13
- you need full container-style isolation with namespaces, cgroups, or seccomp
- you need GUI sandboxing profiles comparable to firejail's application profiles

## Facets
- artifact type: cli-tool
- maturity: active
- function: security
- domain: security, developer-tools
- platform: cli
- tags: landlock, sandboxing, kernel-security, firejail-alternative, process-isolation, no-root, sandbox, command-line, linux

## Member repositories
- Zouuup/landrun (main) score 83

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:06:33.310878+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:41:32.317220+00:00, confidence not recorded.
  - readme: https://github.com/Zouuup/landrun (fetched 2026-08-28T04:06:33.310878+00:00, sha 4b52a61a775c)
- Data as of 2026-08-30T08:39:29.467469+00:00.