Landrun
lastmod 2025-03-24created 2025-03-241 edits
Run any Linux process in a secure, unprivileged sandbox using Landlock LSM. Think firejail, but lightweight, user-friendly, and baked into the kernel.
Sandbox any Linux process with Landlock, without root or containers
Features
- Lightweight sandbox that runs Linux processes securely using Landlock LSM
- Similar to Firejail, but provides kernel-level security and minimal overhead
- Kernel-level security: through Landlock LSM, the process itself sets security policies and controls its execution environment
- Minimizes unnecessary overhead for lightweight, fast execution without performance loss
- Fine-grained file and directory permissions such as read/write/execute
- Can restrict TCP port binding and connections
- Best-Effort mode support : provides compatibility by flexibly applying the security policies available for the kernel version
Requirements
- Linux kernel 5.13 or later with Landlock LSM enabled
- Network restrictions available on Linux kernel 6.8 or later (TCP binding and connections)
- Go 1.18 or later (required when building from source)
Limitations
- Landlock must be supported by the kernel
- Network restrictions require Linux kernel 6.8 or later and Landlock ABI v5
- Some operations require additional permissions
- Files or directories opened before the sandbox is applied are not subject to Landlock restrictions