Integrations#
This page provides non-exhaustive lists of open-source projects that have integrated Landlock sandboxing support. These lists are provided for informational purposes to highlight potentially interesting projects using Landlock, but we have not audited their code.
Sandboxed projects#
Project |
Type |
Source |
Notes |
|---|---|---|---|
Sandbox library |
GitHub repository |
Sandbox library for Bevy game engine |
|
VM monitor |
Merged GitHub PR |
Virtual machine monitor |
|
AI agent |
Merged GitHub PR |
OpenAI’s CLI agent |
|
Network tool |
Merged commit |
Network simulation program |
|
Sandbox library |
Pledge and Unveil implementation for Linux using Landlock and the Cosmopolitan libc |
||
Emulator |
Merged GitHub PR |
DOS emulator for Linux |
|
Network tool |
Network filtering tool (support since v0.5.0) |
||
Lua runtime |
Upstream Documentation |
Lua runtime with Landlock support (since v0.5) |
|
Sandbox library |
GitHub repository |
Header-only sandboxing library |
|
Sandbox library |
Merged GitHub PR |
Rust sandbox library (v0.4.0+) |
|
Sandboxer |
Merged GitHub PR |
SUID sandbox program (v0.9.74+) |
|
Development tool |
Upstream code |
Version control system |
|
AI agent |
Open GitHub PR |
Google’s AI agent |
|
Sandbox library |
GitHub repository |
Official Go library for Landlock, see documentation |
|
Sandbox library |
Haskell bindings for Landlock |
||
Sandboxer |
GitHub repository |
Official Landlock sandboxing tool |
|
Orchestrator |
Upstream documentation |
HashiCorp workload orchestrator |
|
Security tool |
GitHub repository |
USB malware cleaning station |
|
Sandbox library |
GitHub repository |
Official Landlock configuration format and library |
|
Development tool |
Zero-configuration sandboxing for hermetic builds |
||
Sandboxer |
GitHub repository |
Sandboxing tool leveraging Landlock |
|
Sandboxer |
Upstream code |
ChromeOS sandbox manager and library |
|
Specification |
Open GitHub PR |
Open Container Initiative runtime specification |
|
Archive manager |
Open GitHub PR |
Archive manager (forked) |
|
Package manager |
Merged GitLab MR |
Arch Linux package manager (support since v7.0.0) |
|
Authentication |
Open GitHub PR |
Pluggable Authentication Modules |
|
Blockchain |
Merged GitHub PR |
Blockchain SDK |
|
Container runtime |
Open GitHub PR |
OCI container runtime |
|
Sandbox library |
GitHub repository |
Official Rust library for Landlock, see documentation |
|
WebAssembly runtime |
GitHub repository |
WebAssembly runtime with Landlock support |
|
Sandboxer |
Merged GitHub PR |
Utility to run programs with different privileges (support since util-linux v2.40) |
|
Package manager |
Merged GitHub PR |
Package manager (support since v2.72) |
|
Network service |
Merged release |
Applicative protocol multiplexer (v2.1.0+) |
|
Developer tool |
Merged commit |
System call tracer with Landlock syscall support (v5.13+) |
|
Network service |
Merged GitHub PR, see documentation |
Network security monitoring engine (support since v7.0.0) |
|
Service manager |
Open GitHub PR |
System and service manager |
|
Desktop service |
Merged GitLab MR |
GNOME metadata extraction service (GNOME 46+) |
|
Network service |
Merged commit |
Lightweight wiki server |
|
Archive manager |
Merged GitHub PR |
Extraction tool for firmware and file systems (support since v24.12.4) |
|
Network service |
Merged GitHub PR |
LAN file transfer tool with Landlock isolation |
|
Network service |
Merged commit |
Web server in Go (support since v3.2.0) |
|
Network client |
Merged GitHub PR |
Wireguard client (support since 1.0.8) |
|
Archive manager |
Merged commit |
Archive manager and compression library (support since v5.6.0), also see the backdoor incident) |
|
Document viewer |
Merged GitHub PR |
Document viewer (work in progress) |
Examples and proof of concepts#
Project |
Type |
Source |
Notes |
|---|---|---|---|
Graphics |
Example workshop |
Example of sandboxing ImageMagick |
|
Network service |
Example tutorial |
Lightweight web server with sandboxing tutorial |
|
Sandboxer |
Sample from the Linux kernel |
Official Landlock example in C |
Linux distributions#
The following Linux distributions have Landlock enabled in their kernel configuration.
Distribution |
Status |
Source |
|---|---|---|
Enabled by default |
Merged commit |
|
Enabled by default |
Merged commit (5.13.1.arch1-1) |
|
Enabled by default |
Merged GitHub PR (formerly called CBL-Mariner) |
|
Enabled by default |
Same as RHEL |
|
Enabled by default |
||
Enabled by default |
Merged CL |
|
Enabled by default |
Merged commit and commit (Debian Sid since kernel 5.18.16-1) |
|
Enabled by default |
Merged commit (since Fedora 35) |
|
Enabled by default |
Merged GitHub PR |
|
Enabled wrt kernel variant |
Merged commit |
|
Enabled by default |
Merged GitLab MR |
|
Enabled by default |
Merged GitLab MR (since RHEL 9.6.0, backported features up to ABI 5: kernel-5.14.0-568.el9) |
|
Enabled by default |
||
Enabled by default |
Merged commit (since kernel 5.13-rc1) |
|
Enabled by default |
Merged commit (since 20.04 LTS) |
|
Enabled by default |