google/sandboxed-api

Health v2 · maintenance only

Adoption not part of the score

1758 stars · 199 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Google's Sandboxed API (SAPI) automatically generates sandboxes for individual C/C++ libraries, isolating them from the host program using the underlying Sandbox2 technology. It lets developers sandbox a library once and reuse it anywhere with tightly scoped security policies.

Use cases

• sandbox a C/C++ library to contain code execution vulnerabilities
• isolate untrusted third-party libraries without modifying their source code
• apply tightly scoped seccomp-bpf syscall policies per library
• reuse sandbox policies across multiple projects that use the same library
• run untrusted code in a Linux sandbox with namespaces and resource limits
• sandbox individual components of a larger program instead of the whole program

When to choose

• you need fine-grained sandboxing of specific C/C++ libraries on Linux
• you want to isolate code execution vulnerabilities in third-party libraries
• you want reusable sandbox policies instead of reimplementing them per project
• you need a security boundary for your own C/C++ code in production

When to avoid

• you need to sandbox whole programs or CLI tools rather than libraries (use Sandbox2, NSJail, or Minijail directly)
• your project is not on Linux
• you need sandboxing for non-C/C++ languages or managed runtimes
• you need a general-purpose container or VM-level isolation solution

Facets

library · maturity active

security developer-tools security developer-tools backend cpp sandboxing seccomp-bpf sandbox2 c-cpp-libraries security-hardening google linux bazel

Member repositories

For agents

markdown · JSON · MCP: product_card(name="google/sandboxed-api")