google/nsjail

Health v2 · maintenance only

Adoption not part of the score

4074 stars · 359 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

NsJail is a lightweight Linux process isolation tool that uses namespaces, cgroups, rlimits, and seccomp-bpf syscall filters (via the Kafel BPF language) to sandbox untrusted processes. It supports inetd-style TCP listeners, one-shot execution, and repeated re-execution modes, making it useful for sandboxing network services and fuzzing targets.

Use cases

• sandbox an untrusted binary with namespaces and seccomp filters
• run a network service in an inetd-style jail that forks per connection
• repeatedly execute a target process for fuzzing
• limit CPU, memory, and file descriptor usage of child processes
• isolate processes with chroot, pivot_root, and read-only bind mounts
• run commands as an unprivileged user inside a restricted environment

When to choose

• you need fine-grained Linux sandboxing with namespaces, cgroups, and seccomp-bpf in one tool
• you want to sandbox network services or fuzzing targets on Linux
• you need resource limits and filesystem isolation for untrusted code

When to avoid

• you need cross-platform sandboxing on macOS or Windows
• you prefer container-based isolation with full images and orchestration (use Docker instead)
• your kernel lacks support for user namespaces or seccomp-bpf

Facets

cli-tool · maturity stable

security cli developer-tools security developer-tools cli sandboxing process-isolation namespaces seccomp cgroups chroot fuzzing-support command-line linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="google/nsjail")