nono

Spec sheet

Purpose

nono is a kernel-enforced sandbox CLI and SDK for isolating AI agents, scripts, build tools, and other processes.Read 8 Oct 2026 · nono.sh

Product

nono describes itself as agent runtime security with kernel-enforced boundaries for AI agents.Read 4 Oct 2026 · nono.sh

Audience

The maker describes use from individual laptops through fleets of agents and highlights composable policies, per-tool sandboxing, credential protection, and auditable execution.Read 8 Oct 2026 · nono.sh

Support

The documentation links to GitHub for source code and issues and Discord for community support.Read 8 Oct 2026 · nono.sh

Agent compatibility

The site lists Claude Code, OpenCode, Codex, Antigravity, Goose, OpenClaw, GitHub Copilot, Qwen Code, Pi, and Hermes.Read 4 Oct 2026 · nono.sh

Agent integrations

The site lists profiles or registry packages for Claude Code, OpenCode, Codex, Antigravity, Goose, OpenClaw, GitHub Copilot, Qwen Code, Pi, and Hermes.Read 8 Oct 2026 · nono.sh

Audit

Filesystem operations, network attempts, and command executions can be recorded in a SHA-256 Merkle-tree audit trail and exported as JSON.Read 8 Oct 2026 · nono.sh

Credential handling

The site says credentials are injected at the boundary and never exposed to the agent.Read 4 Oct 2026 · nono.sh

Credential protection

With proxy-based credential injection, the agent uses a localhost proxy and does not see the real API key.Read 8 Oct 2026 · nono.sh

Developer interfaces

The documentation lists a CLI, a Rust core library, and Go, TypeScript, and Python SDKs.Read 4 Oct 2026 · nono.sh

Execution isolation

It creates ephemeral, invocation-scoped micro sandboxes for tool calls, with scoped files, network routes, arguments, and credentials.Read 4 Oct 2026 · nono.sh

Installation

The homepage offers a shell installer, Homebrew, and links to Debian, Fedora, Arch, and Nix installation instructions.Read 4 Oct 2026 · nono.sh

Instruction verification

Its Sigstore-based provenance feature verifies whether agent instruction files were signed by trusted identities before execution.Read 8 Oct 2026 · nono.sh

Isolation

It uses Landlock on Linux and WSL2 and Seatbelt on macOS to enforce filesystem allow-lists that cannot be loosened after application.Read 8 Oct 2026 · nono.sh

Kernel enforcement

The OS sandbox uses Landlock on Linux and Windows/WSL2 and Seatbelt on macOS; the page says no root is required.Read 4 Oct 2026 · nono.sh

Network control

The homepage describes proxy-mediated network access where policy can allow or deny requests and route out-of-policy actions for human approval.Read 4 Oct 2026 · nono.sh

Network controls

It can block network access, allow specific domains, filter API endpoints, and route filtered traffic through an upstream proxy.Read 8 Oct 2026 · nono.sh

Policy profiles

JSON profiles define agent access and can be version-controlled alongside code.Read 4 Oct 2026 · nono.sh

Pricing

The maker's site and opened product pages provide no subscription price or paid plan; a maker-authored article describes nono as free and open source.Read 8 Oct 2026 · nono.sh

Rollback

nono can take SHA-256 content-addressed snapshots before and after a session and restore the original state with a command.Read 8 Oct 2026 · nono.sh

SDKs

The documentation describes a Rust core library and Go, TypeScript, and Python SDKs for integrating sandboxing into applications.Read 8 Oct 2026 · nono.sh

Supported platforms

The installation guide lists Linux kernel 5.13+, macOS, and Windows through WSL2 as supported, and says native Windows is not supported.Read 8 Oct 2026 · nono.sh

Windows caveat

On WSL2, the page reports 84% feature parity and says capability elevation and per-port network rules have limitations.Read 4 Oct 2026 · nono.sh

WSL2 limitation

The site reports 84% feature coverage on WSL2 and notes that some advanced capabilities are unavailable because of kernel limitations.Read 8 Oct 2026 · nono.sh

Where Specifiction places it

• Sandbox Software#15 of 267.5