nono

A secure, kernel-enforced capability sandbox for AI agents

[!WARNING] This is an early alpha release that has not undergone comprehensive security auditing or peer review. Some of the core policy files are still undergoing changes. Although care and attention has been made and the author has a long background in security, there are no guarantees regarding maturity or stability. Not recommended for production environments. Please do raise bugs, if you see something wrong, you're probably right.

nono is a secure, kernel-enforced capability shell for running untrusted AI agents and processes. Unlike policy-based sandboxes that intercept and filter operations, nono leverages OS security primitives (Landlock on Linux, Seatbelt on macOS) to create an environment where unauthorized operations are structurally impossible.

Quick Start

MacOS

brew tap lukehinds/nono 
brew install nono

[!NOTE] The package is not in homebrew official yet, give us a star to help raise our profile for when request approval

Linux Package Managers

We are in the process of packaging nono for popular Linux distributions. In the meantime, you can use the prebuilt binaries or build from source.

Building from Source

See the Development Guide for instructions on building nono from source.

Supported Clients

nono ships with built-in profiles for popular AI coding agents. Each profile defines audited, minimal permissions so you can get started with a single command.

Don't see your tool? nono is agent-agnostic and works with any CLI command:

nono run --allow . -- my-agent

Shell Alias (Claude Code example)

For quick access, add a shell function:

sclaude() {
    nono run --profile claude-code --allow . "$@" -- claude
}

Usage:

sclaude                           # Current directory only
sclaude --allow /tmp              # Current directory + /tmp
sclaude --read ~/Documents        # Current directory + read-only ~/Documents

Features

• No escape hatch - Once inside nono, there is no mechanism to bypass restrictions
• Agent agnostic - Works with any AI agent (Claude, GPT, opencode, openclaw) or any process
• OS-level enforcement - Kernel denies unauthorized operations
• Destructive command blocking - Blocks dangerous commands like rm, dd, chmod by default
• Cross-platform - Linux (Landlock) and macOS (Seatbelt)

Usage

# Allow read+write to current directory
nono run --allow . -- command

# Separate read and write permissions
nono run --read ./src --write ./output -- cargo build

# Multiple paths
nono run --allow ./project-a --allow ./project-b -- command

# Block network access
nono run --allow . --net-block -- command

# Dry run (show what would be sandboxed)
nono run --allow . --dry-run -- command

# Check why a path would be blocked
nono why --path ~/.ssh/id_rsa --op read

Command Blocking

nono blocks dangerous commands by default to prevent AI agents from accidentally (or maliciously) causing harm. This provides defense-in-depth beyond filesystem restrictions.

Blocked Commands

The following categories of commands are blocked by default:

Overriding Command Blocks

# Allow a specific blocked command (use with caution)
nono run --allow . --allow-command rm -- rm ./temp-file.txt

# Block an additional command
nono run --allow . --block-command my-dangerous-tool -- my-script.sh

Kernel-Level Protection

nono applies kernel-level protections that limit destructive operations:

• File deletion blocked outside granted paths - unlink/rmdir syscalls are blocked for system paths like /tmp, /dev, and any path not explicitly granted with --allow or --write
• Directory deletion blocked everywhere - rmdir is blocked even within granted write paths (Linux: RemoveDir excluded from Landlock rules; macOS: global deny file-write-unlink with targeted overrides for file deletion only)

Within paths you explicitly grant write access to (--allow or --write), file creation, modification, and deletion are permitted - this is necessary for normal file operations like atomic writes.

# File deletion blocked in system paths (even with --allow-command rm)
$ nono run --allow ./project --allow-command rm -- rm /etc/hosts
rm: /etc/hosts: Operation not permitted

How It Works

┌─────────────────────────────────────────────────┐
│  Terminal                                       │
│                                                 │
│  $ nono run --allow ./project -- agent          │
│                                                 │
│  ┌───────────────────────────────────────────┐  │
│  │  nono (applies sandbox, then exec)        │  │
│  │                                           │  │
│  │  ┌─────────────────────────────────────┐  │  │
│  │  │  Agent (sandboxed)            │  │  │
│  │  │  - Can read/write ./project         │  │  │
│  │  │  - Cannot access ~/.ssh, ~/.aws...  │  │  │
│  │  │  - Network: allowed (or blocked)    │  │  │
│  │  └─────────────────────────────────────┘  │  │
│  └───────────────────────────────────────────┘  │
└─────────────────────────────────────────────────┘

Platform Support

Roadmap

Planned Features

Security Model

nono follows a capability-based security model with defense-in-depth:

1. Command validation - Dangerous commands (rm, dd, chmod, etc.) are blocked before execution
2. Sandbox applied - OS-level restrictions are applied (irreversible)
3. Kernel enforcement - Directory deletion blocked everywhere; file deletion blocked outside granted write paths
4. Command executed - The command runs with only granted capabilities
5. All children inherit - Subprocesses also run under restrictions

Defense Layers

License

Apache-2.0