glycin-ng

In-process image decoder for Linux desktop stacks. Pure-Rust codecs behind a single shared library, layered landlock + seccomp sandbox applied per decode, no helper processes.

                  +-----------------+
                  |  Caller thread  |
                  +--------+--------+
                           |
                           | Loader::load(bytes_or_path)
                           v
        +------------------+------------------+
        |   glycin-ng-worker thread           |
        |  +-------------------------------+  |
        |  | rlimit   (RLIMIT_AS, _CPU)    |  |
        |  +-------------------------------+  |
        |  | landlock (FS + net + scope)   |  |
        |  +-------------------------------+  |
        |  | seccomp  (BPF allowlist)      |  |
        |  +-------------------------------+  |
        |  |   Decoder  (pure Rust crate)  |  |
        |  +-------------------------------+  |
        +------------------+------------------+
                           |
                           | join, return frames + posture
                           v
                  +--------+--------+
                  |  Image, frames  |
                  +-----------------+

Why this exists

Upstream glycin is the loader library new versions of gdk-pixbuf and GNOME apps depend on. It spawns one helper process per format under bwrap, talks to it over peer-to-peer D-Bus, and inherits LGPL / MPL transitive code from the codec libraries those helpers link against (librsvg, libjxl, libheif, libopenraw, ...).

glycin-ng is a from-scratch, MIT/Apache replacement with the same position in the stack but:

If you don't need an in-process boundary and want every available codec including the LGPL ones, you want upstream glycin. If you want permissive licensing or you're packaging into something already sandboxed where bwrap nesting is awkward, you want this.

Status

Pre-release. Public Rust and C surfaces are stable enough to integrate against. Not yet on crates.io. Linux is the first-class target; the sandbox no-ops on other platforms and the library still decodes.

Quickstart

Rust

use glycin_ng::Loader;

let image = Loader::new_path("photo.png").load()?;
let frame = image.first_frame().expect("at least one frame");
let texture = frame.texture();

println!(
    "{}x{} {:?}, {} bytes",
    texture.width(),
    texture.height(),
    texture.format(),
    texture.data().len(),
);

if let glycin_ng::LandlockPosture::Enforced { abi } =
    image.sandbox_posture().landlock
{
    println!("decoded under landlock abi v{abi}");
}

Refuse degraded sandbox:

let image = Loader::new_bytes(bytes)
    .require_sandbox()
    .load()?;

require_sandbox() returns Error::SandboxUnavailable("landlock") (or "seccomp", "rlimit") on any kernel that cannot enforce a selected layer.

C

#include "glycin_ng.h"

GlycinNgLoader *loader = glycin_ng_loader_new_path("photo.png");
GlycinNgImage *image = glycin_ng_loader_load(loader);
if (!image) {
    fprintf(stderr, "%s\n", glycin_ng_last_error());
    return 1;
}

printf("%ux%u\n",
    glycin_ng_image_width(image),
    glycin_ng_image_height(image));

glycin_ng_image_free(image);

Build libglycin_ng.so plus include/glycin_ng.h:

cargo build --release --features c-api

Worked example in examples/c_load.c.

Supported formats

Deferred because no permissive decoder exists yet: HEIF, AVIF, RAW.

Sandbox

Each decode runs on a dedicated glycin-ng-worker thread, joined before the call returns. Three layers stack on that thread:

Toggle layers with Loader::sandbox_selector(SandboxSelector { ... }). Inspect the result with Image::sandbox_posture() and decide whether to log, audit, or refuse a degraded posture.

Landlock negotiates up to ABI V6 at runtime and degrades cleanly. The crate ships built-in regression tests asserting both that an unlisted syscall (socket) is denied under seccomp, and that the worker spawns a rayon pool for JPEG / JXL without tripping clone3.

The dominant cost is the seccomp install: the BPF program is JIT-compiled into the kernel on every prctl(PR_SET_SECCOMP), so its overhead scales with the size of the allowlist. Landlock adds a single-digit microsecond cost on top. Run cargo bench --bench sandbox_overhead for the numbers on your specific hardware.

Limits

Every decode is bounded:

Override via Loader::limits(Limits { ... }).

Feature flags

Minimum build:

cargo build --no-default-features

Trim individual formats:

cargo build --no-default-features --features decode,png,jpeg

Related crates

• glycin-ng-libglycin-shim - libglycin-2.so.0 drop-in for systems that have hard-linked against upstream's libglycin (Arch's gdk-pixbuf2 is the canonical case).
• glycin-ng-pixbuf-loader - single gdk-pixbuf loader module registering every supported MIME, replacing the per-format libpixbufloader-*.so modules.

License

MIT OR Apache-2.0.

CI runs cargo deny check on every push and PR, enforcing that no transitive dependency carries an MPL, LGPL, GPL, or other copyleft license. A failing audit is a blocker.