Sandlock

Sandlock is a lightweight process sandbox for Linux, made by Multikernel, that confines untrusted code such as AI agents and generated scripts. It applies a kernel enforced policy over filesystem, network, system calls and resources in about 5 milliseconds, with no root access, no container runtime, no image and no hypervisor. Enforcement comes in three layers. Landlock handles filesystem, TCP port and IPC rules in the kernel. A seccomp BPF filter removes system call families the workload has no use for. Seccomp user notification passes the remaining decisions, such as which destination IP is allowed or when a memory cap is reached, to a small supervisor. The policy is applied between fork and exec, so the workload never runs unconfined. A single policy can be written as command line flags, a TOML profile, or a struct in Python, Rust or Go. It covers default deny network egress with allowed hosts and ports, an HTTP level access list that can permit a specific method, host and path, credential injection so the sandboxed process never holds the key, copy on write filesystem staging with a dry run mode, and limits on memory, processes, open files, CPU, disk and GPU device selection. Sandlock is open source under Apache 2.0 and written in Rust. Related products include a sandbox HTTP API and a sandbox scheduler, and demos can be booked. No prices are published.