Repolode
Submit
Zouuup

Zouuup/landrun

A lightweight CLI that runs any Linux process in an unprivileged sandbox using Landlock, with fine-grained filesystem and network controls.

Open-source alternative to:Firejail

View on GitHub
Stars
2,322
Forks
55
Open issues
4
Last commit
6 days ago

What is it?

Landrun is a command-line tool that runs a Linux process inside a sandbox built on Landlock, a kernel-native security module that lets unprivileged processes restrict themselves. It requires no root privileges, no containers, and no SELinux or AppArmor policy files. You wrap a command with landrun and list the paths and ports it may use.

Access rules are set per path with flags such as --ro, --rw, --rox and --rwx, and per port with --bind-tcp, --connect-tcp, --bind-udp and --connect-udp. The tool also covers pathname UNIX socket connections, abstract UNIX socket and signal scoping, and audit logging of Landlock denials. Support depends on the kernel: TCP restrictions need Linux 6.7 or later, and UDP restrictions need 7.2 or later. The --best-effort flag lets it fall back to the features an older kernel supports.

If no rules are given and no unrestricted flag is set, landrun denies all access. Environment variables are not passed to the child process unless requested with --env.

Key features

  • 01Runs any Linux command in a Landlock sandbox without root or containers.
  • 02Controls read, write and execute access per file or directory.
  • 03Restricts TCP and UDP bind and connect operations by port or port range.
  • 04Supports pathname UNIX socket access control and IPC scoping.
  • 05Logs Landlock denials for auditing, on supported kernels.
  • 06Uses --best-effort to degrade gracefully on older kernels.

Use cases

  • Confining an untrusted build step, script or third-party binary so it cannot read secrets or reach the network.
  • Running a web server or daemon with access limited to its config, log and web root directories.
  • Restricting a CLI tool to specific ports or a single database socket.
  • Hardening systemd services without writing a full container or MAC policy.

Topics

#sandbox#landlock#linux#security#process-isolation#cli#least-privilege#golang#kernel#sandbox-environment

FAQ

What is landrun?
A lightweight CLI that runs any Linux process in an unprivileged sandbox using Landlock, with fine-grained filesystem and network controls. Landrun is a command-line tool that runs a Linux process inside a sandbox built on Landlock, a kernel-native security module that lets unprivileged processes restrict themselves. It requires no root privileges, no containers, and no SELinux or AppArmor policy files. You wrap a command with landrun and list the paths and ports it may use.
Is landrun free to use? What license does it have?
landrun is open source under the MIT license. Check the license terms before using it in commercial products.
Is landrun still maintained?
Actively maintained. The last commit to landrun was on Oct 16, 2026.
What can I use landrun for?
Confining an untrusted build step, script or third-party binary so it cannot read secrets or reach the network. Running a web server or daemon with access limited to its config, log and web root directories. Restricting a CLI tool to specific ports or a single database socket. Hardening systemd services without writing a full container or MAC policy.
Where can I get landrun?
The source code and installation instructions are on GitHub: https://github.com/Zouuup/landrun

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects