Agent Sandboxesagentsandboxes.org
Sandbox profile · Open-source project

nsjail

Answer in brief

A Linux process isolation tool combining namespaces, cgroups, rlimits and Kafel seccomp-bpf policies, with listen, once and rerun modes for untrusted programs. A strong OS-level jail for execution APIs and CTF-style workloads; pair it with a VM when you need a kernel boundary.

By the Agent Sandboxes editors · Updated

Overview

nsjail is an Apache-2.0 "Linux process isolation tool using namespaces, resource limits, and seccomp-bpf syscall filters" published under Google's GitHub organisation with the note that "This is not an official Google product". It isolates UTS, mount, PID, IPC, network, user, cgroup and time namespaces, constrains the filesystem with chroot or pivot_root and read-only bind mounts, caps CPU time, memory, file descriptors and process count through rlimits and cgroups (v1 and v2), and filters system calls with policies written in the Kafel language. Configuration is by command-line flags or Protocol Buffers config files. Operating modes include a listen mode (inetd-style TCP service), once mode, direct execve mode and a rerun mode for fuzzing.

The documented use cases are hosting CTF challenges, fuzzing, sandboxing desktop applications such as Firefox and running programs in minimal environments with only a few read-only paths exposed; the same shape (bounded CPU, memory and syscalls per execution) is what code-execution APIs need. Some features need root (MACVLAN, --disable_clone_newuser) and others depend on unprivileged user namespaces; time namespaces need kernel 5.3 or later. nsjail 3.6 was released on 18 March, fixing a seccomp policy assembly bug that caused the 3.5 release to be flagged "BROKEN". None of the platforms on this site document building on nsjail.

Notable

  • Hosted under Google's GitHub organisation but "not an official Google product"; Apache-2.0
  • nsjail 3.6 released 18 March; 3.5 was flagged BROKEN because config-file seccomp_string entries were not additive
  • Seccomp policies are written in Kafel; time namespaces need kernel 5.3+, core scheduling 5.14+

nsjail specifications

AttributeDetails
IsolationLinux UTS, mount, PID, IPC, network, user, cgroup and time namespaces, cgroup v1/v2 limits, rlimits, chroot/pivot_root and seccomp-bpf syscall filters written in Kafel
DeploymentOpen-source project · Self-hostable
Open sourceYes (Apache-2.0)
SDKs and interfacesCLI
Cold start (vendor claim)Not documented
Max session lengthConfigurable CPU-time rlimit and wall-clock time limit per jail
PersistenceNone built in; filesystem is whatever you chroot or bind-mount
GPUNot documented
NetworkingNetwork namespace with isolated or cloned Ethernet interfaces, MACVLAN (requires root) or userland networking via pasta
PricingFree and open source
Free tierFree to self-host
ComplianceNot documented
RegionsNot documented

Facts from nsjail’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.

Strengths and trade-offs

Strengths

  • You need per-execution CPU, memory, process and syscall limits for an untrusted code runner
  • You want a single binary with a protobuf config rather than a container runtime
  • You run network-facing untrusted services and want inetd-style listen mode

Trade-offs

  • Shares the host kernel; a kernel bug reachable through the allowed syscalls escapes the jail
  • Linux only, and several features require root or enabled user namespaces
  • No snapshots, persistence or orchestration API
  • Release cadence is irregular and a recent release shipped a seccomp regression

Good fit for: Running untrusted programs or network services under tight syscall, memory and CPU limits on Linux.

How nsjail compares

SandboxIsolationOpen sourceSelf-host / BYOCCold start (vendor)Max sessionSnapshots / pauseGPUSDKs
nsjailNamespaces + seccompYesYes / NoNot documentedConfigurableNo / NoNot documentedCLI
bubblewrapLinux namespacesYesYes / NoNot documentedNot documentedNo / NoNot documentedCLI
FirejailNamespaces + seccompYesYes / NoNot documentedNot documentedNo / NoNot documentedCLI
gVisorUser-space kernelYesYes / Noms (claim)Not documentedYes / Not documentedYesCLI
Judge0isolate (namespaces/cgroups)YesYes / NoNot documented5 s wall (max 20 s)No / NoNoREST API, Python, JavaScript/TypeScript
Pistonisolate in DockerYesYes / NoNot documented3 s run / 10 s compileNo / NoNoREST API

See all nsjail alternatives →

Frequently asked questions

What is nsjail?
A Linux process isolation tool combining namespaces, cgroups, rlimits and Kafel seccomp-bpf policies, with listen, once and rerun modes for untrusted programs. A strong OS-level jail for execution APIs and CTF-style workloads; pair it with a VM when you need a kernel boundary.
How does nsjail isolate code?
nsjail documents its isolation as: Linux UTS, mount, PID, IPC, network, user, cgroup and time namespaces, cgroup v1/v2 limits, rlimits, chroot/pivot_root and seccomp-bpf syscall filters written in Kafel.
Is nsjail open source?
Yes (Apache-2.0). It can be self-hosted.
How much does nsjail cost?
Free and open source Check the official pricing page for current rates.
What are the alternatives to nsjail?
Common alternatives include bubblewrap, Firejail, gVisor, Judge0, Piston. See nsjail alternatives for a full comparison.

Sources

  1. github.com/google/nsjail
  2. github.com/google/nsjail/blob/master/README.md
  3. nsjail.dev
  4. github.com/google/nsjail/releases

Cite this page

Agent Sandboxes. (2026). nsjail. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/sandboxes/nsjail/

Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.