landlock 开源项目推荐（162 个）

domcyrus /rustnet

为你的终端提供按进程网络监控，支持深度包检测。跨平台，沙箱化。

Zouuup /landrun

Run any Linux process in a secure, unprivileged sandbox using Landlock. Think firejail, but lightweight, user-friendly, and baked into the kernel.

fencesandbox /fence

轻量级、无容器的沙箱，用于在限制网络和文件系统的情况下运行命令

multikernel /sandlock

最轻量的沙箱。面向 Linux 的基于进程的沙箱，无容器、无虚拟机、无特权、无提示注入

lordbasex /LordOS

LordOS — a free, fast and secure GNU/Linux distribution based on Debian, with its own desktop environment: display server and Wayland compositor in C, a React UI engine on QuickJS, and private native apps.

landlock-lsm /go-landlock

A Go library for the Linux Landlock sandboxing feature

landlock-lsm /rust-landlock

A Rust library for the Linux Landlock sandboxing feature

GreyhavenHQ /greywall

面向 AI 编程代理的无容器、默认拒绝沙箱。为 Linux 和 macOS 提供内核强制的文件系统、网络和系统调用隔离

89luca89 /clampdown

Run AI coding agents in hardened container sandboxes.

souk4711 /hakoniwa

Process isolation for Linux using namespaces, resource limits, cgroups, landlock and seccomp.

sandboxec /sandboxec

A lightweight command sandbox for Linux, secure-by-default, built on Landlock.

axocoatl /axocoatl

Run coding agents unattended. Agents write the code. Axocoatl writes the receipt. Claude Code, Codex or a local model in a sandbox; the host runs your checks, a different model reviews, and every run ends with a CI exit code and a signed receipt.

marty1885 /landlock-unveil

OpenBSD unveil(2) like function in Linux using Landlock

landlock-lsm /linux

Linux kernel - See Landlock issues

landlock-lsm /landlock-lsm.github.io

该项目在 GitHub 上没有填写描述

shoenig /go-landlock

Go filesystem isolation via Linux landlock sandbox

madeye /LianYaoHu

炼妖壶 — run Claude Code, Codex, or any coding agent in a deny-default sandbox with VPN-only network egress. sandbox-exec + PF on macOS, Landlock/seccomp + iptables on Linux.

cherrchen /dsh-plugin-multi-root-workspace

多文件夹 workspace：让 DSH（DeepSeek Harness）的 Agent 不只能读写主目录，还能同时读写你添加的其他文件夹。Multi-folder workspace for DeepSeek Harness: let the agent read and write several folders at once, not just the primary one.

flavio /podlock

Restrict process execution and file access in Kubernetes Pods with Landlock

quitesimpleorg /exile.h

Painless Linux sandboxing API