A lightweight command sandbox for Linux, built on Landlock.

No daemon. No root. No image build step.

Use it to run risky commands with a tighter blast radius: third-party CLIs, untrusted scripts, generated code, and one-off tooling.

Running untrusted code is often an all-or-nothing choice.

Containers and VMs are great tools, but they can be too much for quick command-level isolation. Containers add image and runtime overhead. VMs add stronger isolation with higher setup and resource cost.

sandboxec focuses on a narrower job: sandbox one command on the current host, with low overhead and explicit allow rules.

See also:

• D. Siswanto, “The most practical, fast, tiny command sandboxing for AI agents,” Dwi Siswanto, Feb. 17, 2026. https://dw1.io/blog/2026/02/17/sandboxec/

• Sandbox existing binaries without modifying application code.
• Restrict filesystem and TCP access with allow-list rules.
• Apply policy right before command execution, so child processes inherit restrictions.
• Keep local workflows simple for CI jobs, local scripts, and developer tooling.

Good fit:

• Running a third-party CLI against a local repo.
• Executing generated code in CI.
• Testing install scripts before trusting them with full host access.
• Wrapping build tools that only need a small slice of the filesystem.

• You need stronger isolation boundaries than Landlock process sandboxing.
• You need multi-tenant isolation between untrusted users/workloads.
• You need resource isolation/quotas (CPU, memory, disk, I/O).
• You need custom root filesystems, full runtime images, or OS-level virtualization.

Use containers or VMs for those cases.

• Linux kernel >= 5.13+ (Landlock support enabled)

sandboxec limits what a process can:

• Read / Write / Execute on the filesystem.
• Bind / Connect on the network (TCP).

Restrictions are applied immediately before launching the target command. Once set, those restrictions apply to that process and its children.

• Using script:

  curl -sSL https://get.sandbox.ec | sh

• Using Go compiler:

  go install go.sandbox.ec/[email protected]

• Or download a pre-built binary from releases page.

• Or build from source:

git clone https://github.com/sandboxec/sandboxec.git
cd sandboxec/
# git checkout v0.3.0
make build
# ./bin/sandboxec --help

sandboxec [OPTIONS] [COMMAND [ARG...]]

Examples:

sandboxec --fs rx:/usr /usr/bin/echo hello
sandboxec --fs rx:/usr -- /usr/bin/ls /usr
sandboxec --fs rx:/usr --net c:<PORT> -- /usr/bin/curl http://127.0.0.1:<PORT>
sandboxec --mode mcp --fs rx:/usr --fs rw:$PWD --net c:443

Available MCP tools:

• exec: Execute a command and return stdout, stderr, and exit_code.
  • Input: command (required), args (optional array).
  • Execution path uses sandboxec runtime with effective policy derived from CLI flags or YAML config.

Format: RIGHTS:PATH

Accepted rights:

• read or r
• read_exec or rx
• write or w
• read_write or rw
• read_write_exec or rwx

Format: RIGHTS:PORT

Accepted rights:

• bind or b
• connect or c
• bind_connect or bc

• Rules are allow-list based: if it is not allowed, it is denied. It is what it is.
• Multiple --fs and --net entries are cumulative.
• Rules should include every runtime dependency your command needs.

Configuration is YAML-only.

abi: 6
best-effort: false
ignore-if-missing: false
restrict-scoped: false
unsafe-host-runtime: false
fs:
  - rx:/bin
net:
  - c:443
mode: run

• If --config is set, that file is used.
• If --named-config is set, the value maps to a profile in the sandboxec/profiles repository.
• Otherwise, sandboxec.yaml or sandboxec.yml is searched in:
  1. $XDG_CONFIG_HOME/sandboxec
  2. $HOME/.config/sandboxec
  3. /etc/sandboxec

If no config file is found, defaults are used.

• --config and --named-config cannot be used together.
• CLI flags override config values for scalar options.
• --fs and --net replace config lists when those flags are set.
• If those flags are not set, rules come from config.

abi: 6
best-effort: true
ignore-if-missing: true
restrict-scoped: false
unsafe-host-runtime: false
fs:
  - rx:/bin
  - rx:/usr
  - rx:/lib
  - rx:/usr/lib
  - rw:/tmp
net:
  - c:443

Looking for ready-made policy profiles? See sandboxec/profiles repository.

• 0: Wrapped command succeeded.
• N: Wrapped command exited with code N.
• 1: sandboxec failed to setup (parsing error, Landlock failure).

• Allow-list only: If a path isn't listed, it is invisible or inaccessible.
• Dependencies: Binaries often need to read /lib, /usr/lib, or shared object dependencies (.so files).
• Unsafe runtime behavior: --unsafe-host-runtime adds read_exec rights for PATH-derived runtime targets and its resolved shared-library dependency files discovered from executable entries, hence it can significantly increase startup latency, especially for short-lived commands.
• Network: Rules control TCP bind/connect. They do not replace firewalls.
• Scope: This is not a full container or VM replacement. It is a fast, command-level control layer for risky workloads.

sandboxec --fs rx:/usr -- /usr/bin/id

sandboxec \
  --fs rx:/bin \
  --fs rx:/usr \
  --fs rw:/tmp \
  -- /bin/ls /tmp

sandboxec \
  --fs rx:/usr \
  --fs rw:$PWD \
  -- your-command

sandboxec --fs rx:/usr --net c:443 -- /usr/bin/curl https://example.com

sandboxec \
  --unsafe-host-runtime \
  --fs rw:$PWD \
  --fs rw:/tmp \
  --net c:443 \
  -- your-build-command

sandboxec --config ./sandboxec.yaml -- /bin/echo ok

sandboxec --named-config agents/claude -- claude --dangerously-skip-permissions

sandboxec \
  --fs rx:/usr \
  --fs rw:$PWD \
  --fs rw:/tmp \
  --net c:443 \
  -- your-build-command

{
  "mcpServers": {
    "sandboxec": {
      "command": "/path/to/go/bin/sandboxec",
      "args": [
        "--mode", "mcp",
        "--fs", "rx:/usr",
        "--fs", "rw:/tmp",
        "--fs", "rw:/path/to/your/workspace",
        "--net", "c:443"
      ]
    }
  }
}

• invalid fs rights: Check spelling (rx, rw, etc.).
• Landlock failures: Your kernel might be too old. Try --best-effort or remove flags that require newer ABIs (like network rules on old kernels).

If commands fail with permission denied:

• Add missing runtime paths (/usr, /lib, /usr/lib, /etc as needed).
• Check kernel capability for requested rule types.
• Retry with --best-effort to confirm whether unsupported ABI features are the blocker.

sandboxec is released with ♡ by @dwisiswant0 under the Apache 2.0 license. See LICENSE.