Skip to content
SPECIFICTION
Get listed

Sandlock

sandlock.io

Free plan LinuxAPISelf-hosted
Visit sandlock.io
Spec score 7.4 #16 of 26 in Sandbox Software

What it is

Sandlock is a Linux process sandbox for confining untrusted code with policies enforced by the kernel. It uses Landlock, seccomp-bpf, and seccomp user notification to control filesystem access, network activity, system calls, and resource use. Policies can deny network egress by default, apply HTTP method, host, and path rules, stage writes through copy-on-write, and set resource limits. A supervisor can attach credentials through a proxy after an HTTP access check, keeping the secret value out of the sandboxed workload. Interfaces include a CLI, Python SDK, Rust API, Go SDK, OCI runtime, and MCP server. The OCI runtime works with containerd, CRI-O, and Kubernetes, while the remote MCP API can connect to Claude Desktop, Cursor, or another MCP client. Sandlock runs as an ordinary user without root, a container runtime, or a hypervisor. Linux 6.12 or later supports the full protection set by default; older kernels require explicit waivers for missing protections. It shares the host kernel, excluding kernel vulnerabilities and hardware side channels from its guarantees.

Spec sheet

Purpose
Sandlock is a lightweight Linux process sandbox for confining untrusted code with kernel-enforced policies.Read 4 Oct 2026 · sandlock.io
Integrations
The OCI runtime works with containerd, CRI-O, and Kubernetes, and the remote MCP API can be used with Claude Desktop, Cursor, or another MCP client.Read 4 Oct 2026 · sandlock.io
Support
Engineering support and a response SLA are included with each commercial license.Read 4 Oct 2026 · sandlock.io
Headquarters
San Jose, California, United StatesRead 28 Sep 2026 · sandlock.io
Company
Sandlock is a Multikernel Technologies project; the maker lists its address as San Jose, California.Read 4 Oct 2026 · sandlock.io
Commercial deployment
The commercial HTTP API and Scheduler are licensed software deployed on the customer's infrastructure, with no hosted or shared-tenant offering.Read 4 Oct 2026 · sandlock.io
Credential handling
The supervisor attaches secrets in the proxy only after the HTTP ACL check, so the sandboxed workload does not hold the secret value.Read 4 Oct 2026 · sandlock.io
Enforcement
It uses Landlock, seccomp-bpf, and seccomp user notification to control filesystem, network, syscalls, and resources.Read 4 Oct 2026 · sandlock.io
Interfaces
The product provides a CLI, Python SDK, Rust API, Go SDK, OCI runtime, and MCP server.Read 4 Oct 2026 · sandlock.io
Kernel requirement
Linux 6.12 or later supports the full protection set by default; older kernels can be used if missing protections are explicitly waived per policy.Read 4 Oct 2026 · sandlock.io
Policy controls
Policies can restrict filesystem access, default-deny network egress, apply HTTP method/host/path rules, inject credentials, stage writes with copy-on-write, and set resource limits.Read 4 Oct 2026 · sandlock.io
Privileges
Sandlock runs as an ordinary user and does not require root, a container runtime, or a hypervisor.Read 4 Oct 2026 · sandlock.io
Threat boundary
Sandlock shares the host kernel, and its security guarantees do not cover kernel vulnerabilities or hardware side channels.Read 4 Oct 2026 · sandlock.io
Use cases
The maker describes use for AI agent tool use, CI and untrusted builds, and per-request code execution.Read 4 Oct 2026 · sandlock.io

Plans and prices

Sandlock Free No caps · no telemetry · no registration · Apache-2.0 Read 4 Oct 2026 · sandlock.io
Sandbox HTTP API Price not published Annual license Unlimited sandboxes and keys per deployment · priced by fleet size · self-hosted Read 4 Oct 2026 · sandlock.io
Sandbox Scheduler Price not published Annual license Priced by node count · self-hosted Read 4 Oct 2026 · sandlock.io

Every Sandlock plan and price →

Strong points and limits

Strong points

  • Free Apache-2.0 plan
  • No root or hypervisor required
  • Filesystem and network policy controls
  • CLI, SDK, OCI, and MCP interfaces
  • Kubernetes integration through OCI runtime

Limits

  • Linux-only sandbox
  • Older kernels need protection waivers
  • Shares the host kernel
  • Commercial offerings are self-hosted

Who it suits

It suits teams running AI-agent tools, CI jobs, untrusted builds, or per-request code execution on Linux. Self-hosted deployments and policy-oriented interfaces fit organizations controlling their own infrastructure.

Verdict

Sandlock provides broad kernel-enforced controls and several integration interfaces without requiring root or a container runtime. Its Linux scope, shared-kernel boundary, and self-hosted commercial deployment should be evaluated before adoption.

Where Specifiction places it

Alternatives to SandlockAll alternatives →

E2B From $150/mo · Free plan 9.1 Visit