nono
Hacker ApprovedRanked 3 of 10 sandboxing tools by recommenders
Recommended as a free, kernel-enforced sandbox that keeps AI coding agents within set file and directory limits. Common caveat: getting access policies right takes work.
Recommended as a free, kernel-enforced sandbox that keeps AI coding agents within set file and directory limits. Common caveat: getting access policies right takes work.
37 people gave an opinion
- recommend it
- 34
- criticize it
- 3
- approval share
- 92%
Recommended in 10 of 13 months
- November 2025: not recommended
- December 2025: not recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it carries the badge
- 34 people recommend itNeeds 10 or more, met.
- 11 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 10 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Kernel-level sandboxing restricts agents
“uses kernel-level enforcement (Landlock/Seatbelt) to restrict what agents can do on your machine”
Comment from 3 Mar 2026 in “Credential Protection for AI Agents: The Phantom Token Pattern” “agents start with zero trust in a kernel isolated sandbox”
Comment from 2 Feb 2026 in “Hacking Moltbook: The AI Social Network Any Human Can Control” “something on the kernel level is the best”
Comment from 19 Mar 2026 in “Nvidia NemoClaw” Easy to use, starts instantly
“Good DX, straightforward permissions system, starts up instantly.”
Comment from 28 Mar 2026 in “Don't YOLO your file system” “Its very easy to use and has a pre-made profile for pi.”
Comment from 5 Aug 2026 in “Pi's Minimalism Is Its Advantage” “it's practically 0 seconds of latency”
Comment from 28 Mar 2026 in “Ask HN: The new wave of AI agent sandboxes?” Works with any agent harness
“Its very easy to use and has a pre-made profile for pi.”
Comment from 5 Aug 2026 in “Pi's Minimalism Is Its Advantage” “Nono wraps my coding agent. It works really well.”
Comment from 9 Oct 2026 in “MXC - a sandboxed code execution system” “This is great because it is harness agnostic”
Comment from 30 Jul 2026 in “Git worktrees are not an isolation boundary for coding agents” Blocks gateway attacks and credential leaks
“Fnox and Nono are the ones I know that do credentials proxying.”
Comment from 16 Aug 2026 in “Show HN: Laptop is the last place your secrets are still in plaintext” “its already negated a few gateway attacks”
Comment from 1 Feb 2026 in “1-Click RCE to steal your Moltbot data and keys” “already negated a few gateway attacks”
Comment from 1 Feb 2026 in “1-Click RCE to steal your Moltbot data and keys”
Other sandboxing tools people recommend
The four most recommended other sandboxing tools, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| Bubblewrap (bwrap) | 109 | 32 | 77% | 12 | — | Approved |
| Agent Safehouse | 43 | 2 | 96% | 7 | — | Approved |
| nonoThis page | 34 | 3 | 92% | 10 | — | Approved |
| Firejail | 30 | 6 | 83% | 12 | — | Approved |
| sandbox-exec | 25 | 7 | 78% | 11 | — | Approved |
What people said
40 of the 58 comments that mention it, newest first. Each links to the original comment.
“It works fine but I had to use nono wrap because the SDK do not ship the builtin profiles which was a little annoying.”
“I immediately implement sandboxes with nono”
“Plus it is a priority for that team so if you are having issues the no labs guys will likely fix it”
“Nono blocks access to the root of $HOME, then selectively allows access to paths within it”
“which uses landlock instead of bubblewrap”
“Nono wraps my coding agent. It works really well.”
“For further isolation, I like to use nono inside a smolvm instance.”
“there have also been GitHub reports about isolation gaps”
“Wrapping it in nono.sh costs approximately zero tokens.”
“ai slop is an instant turn off for me”
“Fnox and Nono are the ones I know that do credentials proxying.”
“With Nono, you describe what you intend to work on at the start of a focus session.”
“This has both features and is open-source”
“You should research bubblewrap and nono.”
“the big advantage is that is has access to the local development tools”
“basically the best coverage you can have”
“I've also heard good things about nono from colleagues”
“Its very easy to use and has a pre-made profile for pi.”
“I pair it with https://nono.sh/ and sleep alot easier at night.”
“nono is great but you'll still won't be able to run multiple dev servers, dbs or test in the browser”
“Nono allows for directory level permissioning, so the entire .git/hooks directory and .git/config are write blocked”
“This is great because it is harness agnostic”
“nono seems good to recommend to coworkers and the like”
“The downside is getting all the policies correct as it seems every project needs some new type of access”
“supports rollbacks for this kind of situation”
“for the use case of running Claude Code in --dangerously-skip-permissions mode, Lima is more hassle than Nono”
“it's practically 0 seconds of latency”
“Good DX, straightforward permissions system, starts up instantly.”
“If anyone wants native python sandboxing without needing a cloud API, we just shipped an early python SDK”
“something on the kernel level is the best”
“If anyone happens to be interested in sandboxing, a community of us are building”
“uses kernel-level enforcement (Landlock/Seatbelt) to restrict what agents can do on your machine”
“someone recently released https://nono.sh/ which seems promising”
“nono is more focused on protecting the environment or workspace itself”
“agents start with zero trust in a kernel isolated sandbox”
“The zeroize after exec feature sounds good, but what is the threat model in an agent context?”
“the answer is no, they cannot escape.”
“its already negated a few gateway attacks”
“this could be a default wrapper for local agent runs”
“already negated a few gateway attacks”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.