Kernel sandboxes for AI agents that aren't VMs

What it does

nono is a Rust runtime that wraps AI agents in capability-based sandboxes enforced by the kernel. It uses Landlock on Linux and Seatbelt on macOS to irreversibly restrict which files, network destinations, sockets, and credentials a process can touch. Agents run inside your real development environment, but only access the specific host resources you explicitly model as capabilities.

The interesting bit

The core library is intentionally policy-free: it applies only the capabilities a caller provides, while the CLI and registry ship composable profiles for popular agents like Claude Code and Codex. That separation lets organizations version and audit policy like code, and the built-in Sigstore attestation of instruction files adds a supply-chain verification layer most sandboxes skip entirely.

Key highlights

• Irreversible kernel restrictions inherited by child processes, so an agent cannot escape its cage by spawning new processes.
• Credential proxy mode that keeps API keys in external keystores or 1Password, entirely outside the sandbox boundary.
• Content-addressable snapshots with SHA-256 deduplication and Merkle-tree integrity for rollback evidence.
• Pre-built policy profiles for agents like Claude Code, Codex, and OpenCode, plus a registry for sharing custom packages.
• Cross-platform support for macOS, Linux, and WSL2.

Caveats

• APIs are still stabilizing ahead of a 1.0 release, so breaking changes may still occur where necessary.
• Native Windows support remains in planning, leaving Windows developers to use WSL2 for now.

Verdict

If you run LLM agents locally and worry about them wandering into sensitive paths or phoning home to cloud metadata endpoints, nono offers a lightweight middle ground between blind trust and full virtualization. Teams already hermetically sealing every agent in its own microVM may find it redundant.