Landlock
Hacker ApprovedKernel sandboxing API in Developer tools
Lets programs restrict their own file access without root or setup, unlike most Linux privilege-dropping options. Caveat: it mostly covers filesystem access, not other areas.
Lets programs restrict their own file access without root or setup, unlike most Linux privilege-dropping options. Caveat: it mostly covers filesystem access, not other areas.
31 people gave an opinion
- recommend it
- 25
- criticize it
- 6
- approval share
- 81%
Recommended in 10 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: not recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it carries the badge
- 25 people recommend itNeeds 10 or more, met.
- 4.2 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 10 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
No root or setup needed
“I like it because it just works as an unprivileged usermode program without setting anything up.”
Comment from 30 Nov 2025 in “Landlock-Ing Linux” “I wrote a small landlock wrapper using go-landlock to sandbox pi that works well”
Comment from 25 Feb 2026 in “Pi – a minimal terminal coding harness” “You know what's also been around and doesn't require root? Landlock.”
Comment from 20 Aug 2026 in “Malicious Rust Crate Arrayref Runs a Build-Time Payload” - Comment from 29 Nov 2025 in “Landlock-Ing Linux”
Used to sandbox AI coding agents
“I wrote a small landlock wrapper using go-landlock to sandbox pi that works well”
Comment from 25 Feb 2026 in “Pi – a minimal terminal coding harness” “deterministic enforcement that the LLM can't reason its way around”
Comment from 23 Feb 2026 in “Kernel-enforced sandbox App and SDK for AI agents, MCP and LLM workloads” “Pi even has a sandbox plugin for Landlock”
Comment from 13 Jul 2026 in “Grok uploaded my user directory to xAI's servers” - Comment from 25 Jul 2026 in “Android May Soon Restrict On-Device ADB”
Lets apps harden themselves
“This lets developers of applications harden themselves, it doesn't require the end-user to do anything”
Comment from 30 Nov 2025 in “Landlock-Ing Linux” “Firejail requires SUID, LandLock does not.”
Comment from 29 Nov 2025 in “Landlock-Ing Linux” “In the application code itself is where landlock shines at the moment.”
Comment from 29 Nov 2025 in “Landlock-Ing Linux” Finally Linux pledge/unveil-like option
“It's the first of its kind on Linux that doesn't completely suck”
Comment from 30 May 2026 in “Openrsync: A BSD-licensed implementation of rsync, by the OpenBSD team” “Finally Linux has something that approaches pledge/unveil”
Comment from 16 Nov 2025 in “Why use OpenBSD?”
What people warn about
Each mark is one comment
Limited beyond filesystem access
“Landlock and Seatbelt reduce filesystem blast radius. They do not give you a separate kernel”
Comment from 23 Sep 2026 in “Sandboxing with Minimal Effort” “Landlock right now doesn't offer a lot for things that aren't file system access.”
Comment from 9 Mar 2026 in “FreeBSD Capsicum vs. Linux Seccomp Process Sandboxing” “Landlock (until ABI v4) offers pretty limited control there”
Comment from 2 Feb 2026 in “Show HN: Nono – Kernel-enforced sandboxing for AI agents” - Comment from 30 Nov 2025 in “Landlock-Ing Linux”
Doesn't work the same on all systems
“Actually that doesn't just work on all systems and it breaks on others.”
Comment from 13 Jul 2026 in “Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop” “Landlock (until ABI v4) offers pretty limited control there”
Comment from 2 Feb 2026 in “Show HN: Nono – Kernel-enforced sandboxing for AI agents”
What people said
35 of the 40 comments that mention it, newest first. Each links to the original comment.
“Landlock and Seatbelt reduce filesystem blast radius. They do not give you a separate kernel”
“Landlock and seccomp are really cool.”
“should be good enough for almost all cases”
“Linux can do seccomp or Landlock or gVisor or a combination.”
“New kernel APIs which I can use in my programs — like landlock”
“You know what's also been around and doesn't require root? Landlock.”
“adopt Landlock in Claude Code”
“Actually that doesn't just work on all systems and it breaks on others.”
“Pi even has a sandbox plugin for Landlock”
“It's the first of its kind on Linux that doesn't completely suck”
“the new Landlock LSM and LSM-eBPF are quite promising”
“Landlock is one of my favorite linux-only APIs”
“combine it with mount and user namespaces and Landlock for filesystem constraints”
“Landlock right now doesn't offer a lot for things that aren't file system access.”
“I've actually found it pretty fine.”
“I understand that Landlock is the way to go”
“I wrote a small landlock wrapper using go-landlock to sandbox pi that works well”
“deterministic enforcement that the LLM can't reason its way around”
“Landlock (until ABI v4) offers pretty limited control there”
“bubblewrap and similar (Landlock, sandbox-exec on Mac) are solid lightweight options”
“Landlock for filesystem restrictions”
“landlock works great in Fil-C”
“doesn't seem anywhere near as nice as pledge() and unveil()”
“the security object must exist when the policy is being established”
“This is massive since most ways of dropping privileges on Linux require already having significant permissions”
“it's on by default and probably can't be turned off”
“I like it because it just works as an unprivileged usermode program without setting anything up.”
“This approach looks like a great start for me.”
“Well that seems like a major oversight there”
“landlock only restricts tcp sockets”
“This lets developers of applications harden themselves, it doesn't require the end-user to do anything”
“In the application code itself is where landlock shines at the moment.”
“it's very easy to write your own LandLock policy in the programming language of your choice”
“Firejail requires SUID, LandLock does not.”
“Finally Linux has something that approaches pledge/unveil”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.