- Home
- Sandbox Software
- Sandlock
Sandlock
San Jose, California, United States
What it is
Sandlock is a lightweight Linux process sandbox for confining untrusted code with kernel-enforced policies. It uses Landlock, seccomp-bpf, and seccomp user notification to control filesystem access, network activity, system calls, and resource use. Policies can deny network egress by default, limit HTTP methods, hosts, and paths, stage writes with copy-on-write, and set resource limits. Sandlock offers a CLI, Python SDK, Rust API, Go SDK, OCI runtime, and MCP server. Its OCI runtime works with containerd, CRI-O, and Kubernetes, while the remote MCP API can connect to Claude Desktop, Cursor, or another MCP client. It runs as an ordinary user without root, a container runtime, or a hypervisor. Linux 6.12 or later supports the full protection set by default. The free Apache-2.0 plan has no caps, telemetry, or registration.
For and against
For
- Kernel-enforced filesystem and network controls
- Runs without root or a hypervisor
- Provides CLI, SDKs, OCI, and MCP interfaces
- Free plan has no caps or registration
- Supports containerd, CRI-O, and Kubernetes
Against
- Linux-only deployment
- Older kernels require waived protections
- Shares the host kernel
- Commercial services are self-hosted
The verdict
Sandlock offers broad policy controls and several integration interfaces for isolating untrusted processes. Its shared-kernel boundary and Linux requirements should shape deployment decisions.
Who it suits
Sandlock suits developers running AI-agent tools, CI jobs, untrusted builds, or per-request code. It is also relevant to teams deploying self-hosted sandbox services.
Plans and prices
Sandlock
No caps · no telemetry · no registration · Apache-2.0
Read 4 Oct 2026 · sandlock.io
Sandbox HTTP API
Unlimited sandboxes and keys per deployment · priced by fleet size · self-hosted
Read 4 Oct 2026 · sandlock.io
Sandbox Scheduler
Priced by node count · self-hosted
Read 4 Oct 2026 · sandlock.io
On the record
- Commercial deployment
- The commercial HTTP API and Scheduler are licensed software deployed on the customer's infrastructure, with no hosted or shared-tenant offering.sandlock.io · read 4 Oct 2026
- Company
- Sandlock is a Multikernel Technologies project; the maker lists its address as San Jose, California.sandlock.io · read 4 Oct 2026
- Credential handling
- The supervisor attaches secrets in the proxy only after the HTTP ACL check, so the sandboxed workload does not hold the secret value.sandlock.io · read 4 Oct 2026
- Enforcement
- It uses Landlock, seccomp-bpf, and seccomp user notification to control filesystem, network, syscalls, and resources.sandlock.io · read 4 Oct 2026
- Integrations
- The OCI runtime works with containerd, CRI-O, and Kubernetes, and the remote MCP API can be used with Claude Desktop, Cursor, or another MCP client.sandlock.io · read 4 Oct 2026
- Interfaces
- The product provides a CLI, Python SDK, Rust API, Go SDK, OCI runtime, and MCP server.sandlock.io · read 4 Oct 2026
- Kernel requirement
- Linux 6.12 or later supports the full protection set by default; older kernels can be used if missing protections are explicitly waived per policy.sandlock.io · read 4 Oct 2026
- Policy controls
- Policies can restrict filesystem access, default-deny network egress, apply HTTP method/host/path rules, inject credentials, stage writes with copy-on-write, and set resource limits.sandlock.io · read 4 Oct 2026
- Privileges
- Sandlock runs as an ordinary user and does not require root, a container runtime, or a hypervisor.sandlock.io · read 4 Oct 2026
- Purpose
- Sandlock is a lightweight Linux process sandbox for confining untrusted code with kernel-enforced policies.sandlock.io · read 4 Oct 2026
- Support
- Engineering support and a response SLA are included with each commercial license.sandlock.io · read 4 Oct 2026
- Threat boundary
- Sandlock shares the host kernel, and its security guarantees do not cover kernel vulnerabilities or hardware side channels.sandlock.io · read 4 Oct 2026
- Use cases
- The maker describes use for AI agent tool use, CI and untrusted builds, and per-request code execution.sandlock.io · read 4 Oct 2026
