nono
container-ishsandbox-libraryopen sourceA cross-platform agent sandbox using Landlock + seccomp on Linux and Seatbelt on macOS, with an L7 credential-injecting proxy.
documentednono.sh OS Sandbox docs ↗
nono is an open-source process sandbox for local AI agents in the same tier as Claude Code's and Codex's sandboxes. On Linux it uses Landlock for filesystem access rules plus seccomp; on macOS it uses Seatbelt. Its network side is a Layer-7 proxy (nono-proxy) that injects credentials at the proxy so secrets never enter the sandbox. It shares the host kernel, the right tool to confine your own agent, not to isolate mutually hostile tenants.
Strengths
- Cross-platform: Landlock + seccomp on Linux, Seatbelt on macOS
- L7 egress proxy injects credentials so secrets never enter the sandbox
- Unprivileged, no daemon, draws the box at launch
Limitations
- Shared kernel, a process sandbox, vulnerable to a kernel LPE
- Landlock path rules need a recent kernel (network rules only from 6.7)
- Built to confine your own agent, not to isolate untrusted multi-tenant code