# Landlock

25 Hacker News commenters recommended Landlock and 6 criticized it, November 2025 to November 2026. It was recommended in 10 of 13 months. It meets the Hacker Approved badge rule.

**Verdict:** Lets programs restrict their own file access without root or setup, unlike most Linux privilege-dropping options. Caveat: it mostly covers filesystem access, not other areas.

## Why people recommend it

- No root or setup needed (4 comments): "I like it because it just works as an unprivileged usermode program without setting anything up." ([source](https://news.ycombinator.com/item?id=46095737)) "I wrote a small landlock wrapper using go-landlock to sandbox pi that works well" ([source](https://news.ycombinator.com/item?id=47145957)) "You know what's also been around and doesn't require root? Landlock." ([source](https://news.ycombinator.com/item?id=49376123))
- Used to sandbox AI coding agents (4 comments): "I wrote a small landlock wrapper using go-landlock to sandbox pi that works well" ([source](https://news.ycombinator.com/item?id=47145957)) "deterministic enforcement that the LLM can't reason its way around" ([source](https://news.ycombinator.com/item?id=47118584)) "Pi even has a sandbox plugin for Landlock" ([source](https://news.ycombinator.com/item?id=48893576))
- Lets apps harden themselves (3 comments): "This lets developers of applications harden themselves, it doesn't require the end-user to do anything" ([source](https://news.ycombinator.com/item?id=46093075)) "Firejail requires SUID, LandLock does not." ([source](https://news.ycombinator.com/item?id=46091451)) "In the application code itself is where landlock shines at the moment." ([source](https://news.ycombinator.com/item?id=46091472))
- Finally Linux pledge/unveil-like option (2 comments): "It's the first of its kind on Linux that doesn't completely suck" ([source](https://news.ycombinator.com/item?id=48338336)) "Finally Linux has something that approaches pledge/unveil" ([source](https://news.ycombinator.com/item?id=45945054))

## What people warn about

- Limited beyond filesystem access (4 comments): "Landlock and Seatbelt reduce filesystem blast radius. They do not give you a separate kernel" ([source](https://news.ycombinator.com/item?id=49816801)) "Landlock right now doesn't offer a lot for things that aren't file system access." ([source](https://news.ycombinator.com/item?id=47312666)) "Landlock (until ABI v4) offers pretty limited control there" ([source](https://news.ycombinator.com/item?id=46854039))
- Doesn't work the same on all systems (2 comments): "Actually that doesn't just work on all systems and it breaks on others." ([source](https://news.ycombinator.com/item?id=48893836)) "Landlock (until ABI v4) offers pretty limited control there" ([source](https://news.ycombinator.com/item?id=46854039))

## Cite as

Hacker Approved, "Landlock", https://hackerapproved.com/p/landlock/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).