nono

Executive Summary

nono is a capability-based, policy-governed runtime for AI agents: it gives a process narrowly scoped access to only the host resources it actually needs — specific paths, network destinations, environment variables, credentials — with policies enforced by kernel primitives, Landlock on Linux and Seatbelt on macOS.^[1] Once restrictions are applied they are irreversible and inherited by every child process; if the agent tries to read ~/.ssh or write outside its granted paths, the operation fails at the syscall level, with no API to escape — not even for nono itself.^[2] The positioning is explicit: the space between "run the agent directly with full access to keys and files" and "seal it inside a separate guest OS."^[1] Sandboxing an agent is one command: nono run --allow ./project -- claude.^[2]

The project is the work of Luke Hinds — creator of Sigstore, the software-signing standard used by PyPI, npm, Homebrew, and Maven Central, and co-founder of supply-chain security startup Stacklok ($17.5M raised, 2023) — now building nono under a new company, Always Further.^[1][3][4] Created January 31, 2026, the repository reached 2,643 stars and 184 forks by June 11, 2026, with commits landing the same day and v0.62.0 released June 7 — the fastest trajectory in the local agent sandbox niche, overtaking landrun's 2,217 stars in a fraction of the time.^[1]

---

Product Overview

The core loop: state what the agent may touch in a profile, and nono applies it before exec'ing the agent. Pre-built policy profiles for popular agents — Claude Code, Codex, Pi, Hermes, OpenCode, OpenClaw — can be pulled from a registry (nono pull), or composed and published as custom profiles; all inbuilt policy can be extended or overridden.^[1] Dangerous defaults are handled out of the box: sensitive paths like ~/.ssh and ~/.aws are protected, and cloud metadata endpoints are hard-denied.^[2][1] A nono why ~/.ssh/id_rsa debugging command explains why an access was blocked.^[2]

Around the kernel sandbox, nono layers what the vendor calls defense in depth: credential proxying, filesystem snapshots with rollback, cryptographic audit logs, supply-chain attestation of agent instruction files, and a runtime supervisor for approval-gated permission expansion.^[4]

Key Capabilities

---

Technical Architecture

nono ships as a single CLI installed via Homebrew, with a policy-free Rust core library that applies only the capabilities a caller provides — the CLI, profiles, and registry packages carry the policy.^[1]

brew install nono
nono run --profile always-further/claude -- claude
nono run --read ./src --write ./target -- cargo build

On Linux, enforcement uses the Landlock LSM (filesystem on kernel 5.13+, network restrictions on 6.7+); on macOS, Apple's Seatbelt handles filesystem and network sandboxing.^[2] The kernel structurally denies unauthorized operations rather than filtering them in userspace, and all child processes inherit the restrictions — a spawned Python script or compiled binary is equally sandboxed.^[2][5] The credential proxy is the architectural piece container-based rivals lack: secrets are injected into outbound requests by a trusted proxy path instead of being placed in the agent's environment.^[1]

Key Technical Details

---

Strengths

• Kernel enforcement with no container tax — restrictions are applied directly to the process via Landlock/Seatbelt, with no daemon, images, or guest OS; the agent works inside the real development environment.^[1][2]
• Credentials never enter the sandbox — the injection proxy is a structurally stronger answer to key exfiltration than any path-blocking approach, since there is nothing in the agent's environment to steal.^[1]
• Cross-platform where the category is fragmented — macOS and Linux from one tool, against Linux-only Landlock wrappers and Docker-dependent alternatives; WSL2 supported, native Windows planned.^[1]
• Pedigree and velocity — built by the Sigstore creator, 2,643 stars in just over four months, same-day commit activity, and three releases in the first week of June 2026 alone.^[1][3]
• More than a sandbox — snapshots/rollback, Merkle-committed audit logs, and Sigstore attestation of CLAUDE.md/SKILLS.md files address prompt-injection supply-chain risk no sibling tool touches.^[1]
• Embeddable — the policy-free Rust core with Python/TypeScript/Go bindings lets agent platforms build nono in rather than shelling out to a CLI.^[1]

---

Cautions

• Pre-1.0 with real churn — APIs are still stabilizing by the project's own notice, and 161 open issues against a four-month-old codebase means early adopters will hit edges.^[1]
• Access control, not full isolation — like all Landlock/Seatbelt approaches, nono restricts filesystem, network, and credentials but does not provide PID namespaces, memory limits, or a separate kernel; the project itself positions containers/VMs as the heavier alternative for full isolation.^[1]
• Environment variables remain a soft spot — HN commenters noted that if secrets are already in the environment and network egress is allowed, an agent can exfiltrate them before mitigations matter; the proxy mode exists precisely to avoid putting keys in the environment, but you have to use it.^[5][1]
• Real-world friction at the device layer — an independent adopter hit a Bun/Claude Code segmentation fault that required manually granting /dev/tty, /dev/null, and /dev/urandom before the agent would run.^[6]
• Community discussion is thinner than the star count suggests — the Show HN drew only 4 points and 5 comments, and most third-party coverage traces back to the author's own launch posts.^[5][2]
• Commercial trajectory is undefined — Always Further is recruiting enterprise design partners with no published pricing, so the open-core boundary between the Apache-2.0 runtime and a future paid product is not yet drawn.^[4]

---

What Developers Say

Community commentary is still sparse relative to the project's growth: the February 2026 Show HN drew just 5 comments, with the launch-month Hugging Face post and a handful of independent adoption write-ups making up the rest.^[5][2]

"I think with access to bash any AI agent can write a basic python/bash script and run it to evade you sandbox, Right?" — gossterrible on Hacker News^[5]

"All child processes inherit the restrictions—if the agent spawns Python, Bash, or compiles and runs a binary, that process is equally sandboxed." — decodebytes (Luke Hinds, the author — vendor voice) in reply^[5]

"If the agent can run printenv in the first millisecond and exfiltrate it (if net is allowed), zeroizing won't help." — veunes on Hacker News^[5]

"Biggest thing I'd want as a user is very explicit docs on the remaining gaps (macOS read-permissive mode, procfs/env/subprocess behavior)." — sukinai on Hacker News^[5]

"nono blocked access to this command, and gave me some feedback about why the command failed." — Shane Boulden, in an independent OpenShift + Claude Code write-up^[6]

---

Pricing & Licensing

Licensing model: Apache-2.0 for the runtime, libraries, and bindings on GitHub; the company behind it is venture-style but undisclosed in structure, with hiring open.^[1]

Hidden costs: None today — you bring your own agent and API keys. The risk is forward-looking: an undefined open-core line once enterprise packaging lands.^[4]

---

Competitive Positioning

Direct Competitors

When to Choose nono Over Alternatives

• Choose nono when: you run agents on macOS and Linux and want one kernel-enforced tool, when API-key exfiltration is your top threat (the proxy keeps keys out entirely), or when you need audit trails and rollback evidence for organizational policy.
• Choose Landrun when: you are Linux-only and want the smallest possible auditable binary, and can accept an unmaintained dependency.
• Choose YOLObox when: you want full container isolation with pre-baked agent images and don't mind the Docker dependency.
• Choose Anthropic Sandbox Runtime when: you are all-in on Claude Code and prefer first-party defaults over a third-party policy layer.

---

Ideal Customer Profile

Best fit:

• Developers running Claude Code, Codex, or OpenCode in YOLO/full-permission mode on their own machines who want kernel-level guarantees that ~/.ssh, ~/.aws, and API keys are unreachable
• Teams that want versioned, reviewable, shareable sandbox policy — a standard profile per agent class, with audit records^[1]
• Agent platform builders who want to embed capability enforcement via the Rust/Python/TypeScript/Go libraries^[1]

Poor fit:

• Workloads needing full isolation — memory/CPU limits, separate kernel, multi-tenant hostile code (use microVMs or containers)
• Native Windows environments (WSL2 only today)^[1]
• Teams that require a 1.0-stable, slow-moving dependency^[1]

---

Viability Assessment

The pedigree-to-traction combination is the story: the Sigstore creator applying supply-chain security instincts (attestation, audit, provenance) to agent runtime safety, with the fastest star growth in the niche and an active release cadence — exactly the maintenance profile landrun lacked.^[1][3] The risks are the usual pre-1.0 ones, plus a commercial layer that hasn't been priced.^[4]

---

Bottom Line

nono is currently the most complete answer to local agent sandboxing: kernel-enforced and irreversible like landrun, cross-platform unlike it, container-free unlike yolobox, and alone in keeping credentials structurally outside the sandbox via its injection proxy. The Sigstore-rooted attestation and audit layers suggest where it's headed — agent runtime safety as organizational policy, not just personal hygiene. It is also four months old, pre-1.0, and backed by a company whose business model is not yet visible.

Recommended for: Developers and teams running coding agents in full-permission mode on macOS or Linux who want kernel-level guarantees plus credential isolation, and platform builders who want an embeddable enforcement library.

Not recommended for: Hostile multi-tenant isolation, native Windows, or teams that need API stability and an established support contract today.

Outlook: The strongest momentum in the local agent sandbox niche. Watch the 1.0 release, the enterprise design-partner program's pricing, and whether Anthropic's first-party sandbox runtime narrows the gap nono fills for Claude Code users.

---

Research by Ry Walker Research • methodology