Sandlock
What Sandlock is
Sandlock is a Linux process sandbox for running untrusted code under policies enforced by the kernel. It uses Landlock, seccomp-bpf, and seccomp user notification to govern filesystem access, network activity, system calls, and resource use. Policies can deny network egress by default, allow HTTP requests according to method, host, and path, stage writes with copy-on-write, and set resource limits. A supervisor can attach credentials through a proxy after an HTTP access check, keeping the secret value out of the sandboxed workload.
The product includes a CLI, Python SDK, Rust API, Go SDK, OCI runtime, and MCP server. The OCI runtime works with containerd, CRI-O, and Kubernetes; the remote MCP API can connect to Claude Desktop, Cursor, or another MCP client. Sandlock runs as an ordinary user without root, a container runtime, or a hypervisor. Linux 6.12 or later supports the full protection set by default; older kernels can be used when missing protections are explicitly waived by policy. Sandlock shares the host kernel, so its security guarantees do not cover kernel vulnerabilities or hardware side channels. The free plan costs nothing and is Apache-2.0. Commercial HTTP API and Scheduler licenses are self-hosted, with engineering support and a response SLA included.
Who it suits
Sandlock suits developers and operators who need to run untrusted code for AI agent tool use, CI builds, or per-request execution under kernel-enforced policies. Its CLI, language interfaces, OCI runtime, and MCP server support several ways to integrate it into a self-hosted environment.
What it does well
- Free Apache-2.0 plan has no caps, telemetry, or registration.
- Controls filesystem, network, system calls, and resource use.
- Runs as an ordinary user without root or a hypervisor.
- Includes CLI, Python, Rust, Go, OCI, and MCP interfaces.
- Credentials can be attached after HTTP access checks.
What to know first
- Requires Linux; full protection set defaults to Linux 6.12 or later.
- Shares the host kernel; kernel vulnerabilities and hardware side channels are outside its guarantees.
- Commercial API and Scheduler are self-hosted licensed software.
- Commercial license prices are based on fleet size or node count.
Limits
The free plan has no caps. Commercial HTTP API and Scheduler licenses are annual and self-hosted; the HTTP API is priced by fleet size and the Scheduler by node count.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Sandlock | No caps · no telemetry · no registration · Apache-2.0 | Free |
| Sandbox HTTP API | Annual license · Unlimited sandboxes and keys per deployment · priced by fleet size · self-hosted | On request |
| Sandbox Scheduler | Annual license · Priced by node count · self-hosted | On request |
As sandlock.io lists them, read 4 Oct 2026. The maker's own page has the final word.
Getting started
- Visit the Sandlock website.
- Use the free plan, which requires no registration.
- Run Sandlock on Linux; Linux 6.12 or later supports the full protection set by default.
- Choose an interface such as the CLI, Python SDK, Rust API, Go SDK, OCI runtime, or MCP server.
- For commercial use, deploy the HTTP API or Scheduler on your infrastructure under an annual license.
Verdict
Choose Sandlock if you need a free Linux sandbox with policy controls and several integration interfaces. It can also fit self-hosted commercial deployments that need the HTTP API or Scheduler and included engineering support. Look elsewhere if you need a hosted or shared-tenant commercial service, or security guarantees covering kernel vulnerabilities or hardware side channels.
Questions
Is Sandlock free?
Yes. Its free plan costs nothing, with no caps, telemetry, or registration, and is Apache-2.0.
Which platforms does Sandlock support?
Sandlock is listed for API, Linux, and self-hosted use. Linux 6.12 or later supports the full protection set by default.
What commercial plans are available?
The Sandbox HTTP API and Sandbox Scheduler are annual self-hosted licenses. The API is priced by fleet size and the Scheduler by node count; prices are not included here.
Does Sandlock offer a hosted commercial service?
No. The commercial HTTP API and Scheduler are deployed on the customer's infrastructure; there is no hosted or shared-tenant offering.
What integrations does Sandlock support?
Its OCI runtime works with containerd, CRI-O, and Kubernetes. The remote MCP API can be used with Claude Desktop, Cursor, or another MCP client.
Who makes Sandlock?
Sandlock is a Multikernel Technologies project. The maker lists its address in San Jose, California.
Facts from Sandlock's own pages
- Commercial deployment
- The commercial HTTP API and Scheduler are licensed software deployed on the customer's infrastructure, with no hosted or shared-tenant offering. · sandlock.io, 4 Oct 2026
- Company
- Sandlock is a Multikernel Technologies project; the maker lists its address as San Jose, California. · sandlock.io, 4 Oct 2026
- Credential handling
- The supervisor attaches secrets in the proxy only after the HTTP ACL check, so the sandboxed workload does not hold the secret value. · sandlock.io, 4 Oct 2026
- Enforcement
- It uses Landlock, seccomp-bpf, and seccomp user notification to control filesystem, network, syscalls, and resources. · sandlock.io, 4 Oct 2026
- Headquarters
- San Jose, California, United States · sandlock.io, 28 Sept 2026
- Integrations
- The OCI runtime works with containerd, CRI-O, and Kubernetes, and the remote MCP API can be used with Claude Desktop, Cursor, or another MCP client. · sandlock.io, 4 Oct 2026
- Interfaces
- The product provides a CLI, Python SDK, Rust API, Go SDK, OCI runtime, and MCP server. · sandlock.io, 4 Oct 2026
- Kernel requirement
- Linux 6.12 or later supports the full protection set by default; older kernels can be used if missing protections are explicitly waived per policy. · sandlock.io, 4 Oct 2026
- Policy controls
- Policies can restrict filesystem access, default-deny network egress, apply HTTP method/host/path rules, inject credentials, stage writes with copy-on-write, and set resource limits. · sandlock.io, 4 Oct 2026
- Privileges
- Sandlock runs as an ordinary user and does not require root, a container runtime, or a hypervisor. · sandlock.io, 4 Oct 2026
- Purpose
- Sandlock is a lightweight Linux process sandbox for confining untrusted code with kernel-enforced policies. · sandlock.io, 4 Oct 2026
- Support
- Engineering support and a response SLA are included with each commercial license. · sandlock.io, 4 Oct 2026
- Threat boundary
- Sandlock shares the host kernel, and its security guarantees do not cover kernel vulnerabilities or hardware side channels. · sandlock.io, 4 Oct 2026
- Use cases
- The maker describes use for AI agent tool use, CI and untrusted builds, and per-request code execution. · sandlock.io, 4 Oct 2026
Where Sandlock stands on Freedom251
- Sandbox Software#13 of 26