Sandlock - Kernel-Enforced Sandboxing for Untrusted Code↗
sandlock.io
Sandlock confines untrusted code on Linux using Landlock, seccomp-bpf, and seccomp user notification. No root, no containers, no hypervisor. A programmable sandbox with kernel-enforced policy for safe execution of untrusted workloads.