Agent sandbox: limits the kernel enforces, not the agent
An agent sandbox is a set of restrictions applied to a coding agent's process so that, whatever the model decides, the process can only read and write the paths and reach the network ports its task needs. On Linux, Landlock lets an unprivileged process restrict its own file and TCP access for good, and seccomp blocks chosen system calls; both are inherited by every child the agent starts.
At a glance
What it limits
Which files can be opened, which ports reached, which syscalls made
Who enforces it
The Linux kernel, not the agent or its prompt
Landlock
Unprivileged allow-list for files and TCP ports (kernel 6.12+ for scopes)
seccomp
Filters system calls, e.g. no unix sockets, so no session D-Bus
Stack
What a sandboxed agent can reach
Only the top two layers are writable; the rest is invisible or read-only.
4
Everything else: ~/.ssh, secrets, other projectscannot be opened
3
System and tool directories, repository historyread only
2
The agent CLI's own state and cachesread and write
1
Task worktreeread and write
Why not just use a container?
You can, and for untrusted code from strangers a container or VM is the safer
default. For a fleet that starts dozens of short agent runs on your own
repositories, Landlock is lighter: no daemon, no image, no volume permissions,
just a process that restricts itself before it starts the agent. The catch is
that it only covers what the kernel version supports, so a sandbox must refuse to
run, not quietly run unconfined, on a kernel that cannot enforce it.
What can still go wrong?
Anything that runs agent-written code outside the sandbox. A verification step
that executes the agent’s test files or build scripts, or a git command that
reads configuration the agent could change, gives the agent a way around its
limits. The rule is simple: everything that executes something the agent could
have edited runs inside the same sandbox.
Check it yourself
# ABI 1+ means Landlock is available; 6+ adds TCP and scope rules
python3 -c "import ctypes; print(ctypes.CDLL(None).syscall(444, None, 0, 1))"
444 is landlock_create_ruleset on x86_64 and aarch64; a negative number means the kernel has Landlock off.
A sandbox gives you
A hard limit that holds even when the model is wrong or manipulated
Secrets and SSH keys the agent cannot open at all
Startup in milliseconds, without a container daemon
It does not give you
Correct code: that is what gates are for
Protection for anything you list as writable
Safety if it silently falls back to running unconfined