Landrun is a lightweight, user-friendly Linux sandbox tool that leverages kernel-level Landlock security to run processes with fine-grained filesystem and network restrictions without requiring root or containers.
Run any Linux process in a secure, unprivileged sandbox using Landlock. Think firejail, but lightweight, user-friendly, and baked into the kernel.
Landrun is used to securely sandbox Linux commands and processes by restricting their filesystem and network access, making it ideal for developers, system administrators, and security professionals who want to isolate applications without complex configurations or elevated privileges. It enables running potentially risky or untrusted commands safely on Linux systems with minimal overhead.
Requires Linux kernel 5.13 or later with Landlock enabled; network restrictions need kernel 6.7 or later. Users must explicitly specify filesystem paths and network ports to allow. No environment variables are passed by default; use --env to pass them. The --best-effort flag enables graceful fallback on older kernels. Properly including system directories like /usr/bin and /usr/lib is necessary for sandboxed commands to run correctly.
Run `go install github.com/zouuup/landrun/cmd/landrun@latest` for quick install
Clone the repository: `git clone https://github.com/zouuup/landrun.git`
Build from source: `cd landrun` then `go build -o landrun cmd/landrun/main.go`
Copy binary to system path: `sudo cp landrun /usr/local/bin/`
Install via Arch AUR stable package maintained by Vcalv
Install via Arch AUR latest commit package maintained by juxuanu
Install on Slackware using Slackbuild maintained by r1w1s1 with `sudo sbopkg -i packagename`landrun [options] <command> [args...]
Run a Linux command inside the Landrun sandbox with specified options
--ro <path>
Allow read-only access to the specified path
--rox <path>
Allow read-only access with execution permissions to the specified path
--rw <path>
Allow read-write access to the specified path
--rwx <path>
Allow read-write access with execution permissions to the specified path
--bind-tcp <port>
Allow binding to the specified TCP port
--connect-tcp <port>
Allow connecting to the specified TCP port
--env <var>
Pass environment variables to the sandboxed command
--best-effort
Enable best effort mode to fall back to less restrictive sandboxing if needed
--log-level <level>
Set the logging level (error, info, debug)
--unrestricted-network
Disable all network restrictions allowing full network access
--unrestricted-filesystem
Disable all filesystem restrictions allowing full filesystem access
--add-exec
Automatically add the executing binary to read-only with execution permissions
--ldd
Automatically add required libraries to read-only with execution permissions