Agent Sandboxesagentsandboxes.org
Sandbox profile · Local / OS-level

nono

Answer in brief

Kernel-enforced OS-native sandbox for coding agents that runs each tool call in its own ephemeral sandbox, brokers credentials and keeps a tamper-evident audit chain. A strong choice for per-tool-call policy and credential brokering around local coding agents, provided OS-level isolation is enough for your threat model.

By the Agent Sandboxes editors · Updated

Overview

nono, from nolabs ("Created by the team behind Sigstore"), wraps an agent process in an OS-enforced sandbox: Landlock on Linux and Seatbelt on macOS, with optional Linux namespaces, and runs on WSL2. You start an agent with a signed profile from the registry (nono run --profile claude-code -- claude); supported agents include Claude Code, Codex, OpenCode, Goose, GitHub Copilot and others. The distinctive part is tool brokering: "Every tool call gets an ephemeral micro toolbox", where a supervisor verifies the executable and arguments and launches a short-lived sandbox, while credentials stay with the supervisor and are injected by a proxy.

Sessions produce a hash-chained audit log sealed with a Merkle root, tracked files can be rolled back from verified snapshots, and skills, hooks and instruction files can be verified with Sigstore. The core is a Rust library with Python, TypeScript and Go SDKs. The README says "In the lead-up to a 1.0 release, APIs are stabilizing"; no alpha or beta label is used.

Notable

  • README: "In the lead-up to a 1.0 release, APIs are stabilizing"
  • Enforcement via Landlock (Linux) and Seatbelt (macOS); macOS, Linux and Windows (WSL2) supported
  • Signed agent profiles distributed through registry.nono.sh

nono specifications

AttributeDetails
IsolationOS-level sandboxing via Landlock on Linux and Seatbelt on macOS, with opt-in user, network, IPC and UTS namespaces on Linux; a supervisor launches each tool call in a short-lived sandbox with only the capabilities it needs
DeploymentLocal / OS-level
Open sourceYes (Apache-2.0)
SDKs and interfacesCLI, Rust, Python, JavaScript/TypeScript, Go
Cold start (vendor claim)Website: "zero setup and zero latency" (claim); no figures given
Max session lengthNot documented
PersistenceRuns on the host filesystem within allow-listed paths; rollback restores tracked files from verified snapshots
GPUNot documented
NetworkingDomain filtering and API rules by HTTP method and path through a proxy that injects credentials at the boundary; the real credential "never enters the child"; block_network() in the SDKs
PricingFree (Apache-2.0); a "nolabs Enterprise" offering is mentioned without pricing
Free tierFree
ComplianceNot documented
RegionsNot documented

Facts from nono’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.

Strengths and trade-offs

Strengths

  • You want kernel-enforced allow-lists around an existing coding agent without containers or VMs
  • You need credentials kept out of the agent process and injected per request
  • You want a tamper-evident audit trail and file rollback for agent sessions
  • You are on macOS or Linux and want zero-setup enforcement

Trade-offs

  • OS-level sandboxing shares the host kernel; not a VM boundary
  • Pre-1.0 with APIs still stabilising
  • Native Windows is only via WSL2; no hosted option

Good fit for: Running Claude Code, Codex and other coding agents on your own machine with kernel-enforced file and network allow-lists and brokered credentials.

Use cases nono fits

  • Local agents: Kernel-enforced file and network allow-lists plus brokered credentials for Claude Code, Codex and other local agents.

How nono compares

SandboxIsolationOpen sourceSelf-host / BYOCCold start (vendor)Max sessionSnapshots / pauseGPUSDKs
nonoLandlock / SeatbeltYesNo / NoNot documentedNot documentedYes / Not documentedNot documentedCLI, Rust, Python, JavaScript/TypeScript, Go
Anthropic Sandbox RuntimeOS-level (Seatbelt / bubblewrap)YesYes / Not documentedProcess startNot documentedNo / NoNot documentedCLI (srt), TypeScript (npm)
Codex CLI sandboxingSeatbelt / bubblewrap / WindowsYesNo / NoNot documentedNot documentedNo / Not documentedNot documentedCLI
Gemini CLI sandboxingSeatbelt or containerYesNo / NoNot documentedNot documentedNo / Not documentedNot documentedCLI
Minimalnamespaces or libkrun microVMYesNo / NoNot documentedNot documentedNot documented / Not documentedNot documentedCLI, MCP server
bubblewrapLinux namespacesYesYes / NoNot documentedNot documentedNo / NoNot documentedCLI
agents-sandboxmicrosandbox microVMYesNo / NoNot documentedNot documentedNot documented / Not documentedNot documentedCLI

See all nono alternatives →

Frequently asked questions

What is nono?
Kernel-enforced OS-native sandbox for coding agents that runs each tool call in its own ephemeral sandbox, brokers credentials and keeps a tamper-evident audit chain. A strong choice for per-tool-call policy and credential brokering around local coding agents, provided OS-level isolation is enough for your threat model.
How does nono isolate code?
nono documents its isolation as: OS-level sandboxing via Landlock on Linux and Seatbelt on macOS, with opt-in user, network, IPC and UTS namespaces on Linux; a supervisor launches each tool call in a short-lived sandbox with only the capabilities it needs.
Is nono open source?
Yes (Apache-2.0).
How much does nono cost?
Free (Apache-2.0); a "nolabs Enterprise" offering is mentioned without pricing Check the official pricing page for current rates.
What are the alternatives to nono?

Sources

  1. nono.sh
  2. nono.sh/docs
  3. nono.sh/docs/core/overview.md
  4. nono.sh/docs/quickstart.md
  5. nono.sh/docs/llms.txt
  6. github.com/nolabs-ai/nono

Cite this page

Agent Sandboxes. (2026). nono. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/sandboxes/nono/

Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.