A package manager that spawns rootless SubOS jails for your tools

What it does

xlings is a cross-platform package manager and isolation layer. It installs software into a global, reference-counted store so multiple versions coexist without duplication, then exposes them through three tiers of SubOS isolation: shell-level PATH switching, filesystem sandboxes via bwrap or proot, and optional image-level mounts. A project-local .xlings.json can automatically activate a SubOS when you enter the directory, aiming for reproducible team environments without host contamination.

The interesting bit

Instead of treating AI agents as external callers, xlings puts the agent inside the SubOS—giving it full permissions to install packages and mutate files while the host stays untouched. It also speaks NDJSON over stdio via xlings interface, so agents and CI pipelines can drive it programmatically without parsing human-readable logs.

Key highlights

• Three isolation levels: shell (env switch), filesystem (bwrap/proot, rootless), and image (ext4 sparse mount, requires root).
• Decentralized package index: official, third-party, and self-hosted Git-based repositories.
• Storage deduplication through version-views and reference counting; the README claims N environments cost roughly one install’s worth of disk space.
• Cross-platform support for Linux, macOS, and Windows with no background daemon.
• Built-in NDJSON event stream for programmatic control by agents and automation; the official index currently holds 60+ packages.

Caveats

• The README still carries a “TODO: 30s demo GIF here” placeholder, suggesting the project is polishing its onboarding visuals.
• Image-level SubOS isolation requires root privileges, breaking the otherwise rootless design for that tier.
• Luban Linux and several ecosystem pieces are marked “upcoming” or not yet published, so the OS-level integration remains aspirational.

Verdict

Worth a look if you juggle conflicting tool versions, want per-project environments lighter than Docker, or need to sandbox AI agents without VM overhead. Skip it if you rely on mature, broad package repositories like Nixpkgs or need fully rootless block-device isolation.