Fast, kernel-enforced application sandbox for macOS and Linux. Default-deny TOML profiles, Seatbelt + Landlock + seccomp + namespaces under the hood. Pasta/slirp4netns auto-plumbed network with per-IP nftables.
macoslinuxrustclisecurityipcsandboxsandboxingseccompisolationcageseatbeltprivilege-separationdevsecopscontainer-securitydefense-in-depthsupply-chain-securitylandlockappsandbox
-
Updated
Jul 18, 2026 - Rust