Show Nono Kernel-enforced Sandboxing Agents Hey
backend · 1 signals · 0 sources
Evidence
Show HN: Nono – Kernel-enforced sandboxing for AI agents — Hey HN<p>Luke here.<p>I built nono and got it out quick then I expected, in response to the openclaw carnage, but its use is beyond openclaw.<p>The problem: AI agents execute code on your machine. Prompt injections, hallucinations, or compromised tools can read ~/.ssh, exfiltrate credentials, or worse. Application-level sandboxes can be bypassed by the code they're sandboxing.<p>I have been around security for a long old time now (i started something called sigstore a few years back) and have seen this pattern so many times before.<p>The solution pitch: nono uses OS-level isolation that userspace can't escape:<p>Linux: Landlock LSM (kernel 5.13+) macOS: Seatbelt (sandbox_init) After sandbox + exec(), there's no syscall to expand permissions. The kernel says no.<p>What it does:<p>nono run --read ./src --allow ./output -- cargo build nono run --profile claude-code -- claude nono run --allow . --net-block -- npm install nono run --secrets api_key -- ./my-agent<p>Filesystem: read/write/allow per directory or file Network: block entirely (per-host filtering planned) Secrets: loads from macOS Keychain / Linux Secret Service, injects as env vars, zeroizes after exec<p>Technical details:<p>Written in Rust. ~2k LOC. Uses the landlock crate on Linux, raw FFI to sandbox_init() on macOS. Secrets via keyring crate. All paths canonicalized at grant time to prevent symlink escapes.<p>Landlock ABI v4+ gives us TCP port filtering. Older kernels fall back to full network allow/deny. macOS Seatbelt profiles are generated dynamically as Scheme-like DSL strings.<p>Limitations:<p>macOS: Currently allows all reads to make executables work. Tightening in next release. Linux: Landlock doesn't cover everything (no UDP filtering until recent kernels, no syscall filtering - that's seccomp territory) No Windows support (yet?)<p>Origin:<p>Built this for OpenClaw (AI agent platform handling Telegram/WhatsApp messages). Needed real isolation, not "please don't read this file" isolation. Generalized it because every agent runner has this problem.<p>GitHub: <a href="https://github.com/lukehinds/nono" rel="nofollow">https://github.com/lukehinds/nono</a> Docs: <a href="https://docs.nono.dev" rel="nofollow">https://docs.nono.dev</a> Site: <a href="https://noto.sh" rel="nofollow">https://noto.sh</a><p>Apache 2.0. Would love feedback on the security model, especially from folks who've worked with Landlock or Seatbelt. Having said that, the code needs a good tidy and I am not exactly proud of it, so go easy on me!