#seccomp

Provide powerful tools for seccomp analysis

The lightest AI sandbox. A process-based sandbox for Linux, no container, no VM, no privilege, no prompt injection

Process isolation for Linux using namespaces, resource limits, cgroups, landlock and seccomp.

Safe-by-default script sandbox in Go. Runs programs under default-deny OS isolation on Linux (bubblewrap + Landlock + seccomp): credential shielding, per-host network allowlisting via a host-side CONNECT proxy, resource limits, and a profile-then-grant consent flow. macOS support is planned.

a fast, rootless sandbox and virtual resource runtime. Run any workload in a real container, including an agent's tool-call or LLM-generated code.

Automatic Kubernetes security profile generator — Landlock, NetworkPolicy, seccomp, and Linux capabilities — built on observation of a running pod, not manual rule authoring.

Run AI-generated JavaScript from Python, securely, in a sandbox: real V8 in a supervised, OS-sandboxed worker process (Seatbelt, Landlock, seccomp), with your Python functions as the only way out.