Sandlock

Linux · Self-hosted · API

Freedom report

Two barsScore 6.3

Free tierA free tier is on its own pricing page
Open codeNo open-source code on record
Runs widely1 of 6 device platforms
DocumentedPlans, terms and facts published

Sandlock is ranked #11 of 22 in sandbox software on Freedom251. It runs on API, Linux, Self-hosted. There is a free plan.

Sandlock plans and pricing

All plans

Sandlock Free No caps · no telemetry · no registration · Apache-2.0 sandlock.io · 4 Oct 2026

Sandbox HTTP API Not published Annual license Unlimited sandboxes and keys per deployment · priced by fleet size · self-hosted sandlock.io · 4 Oct 2026

Sandbox Scheduler Not published Annual license Priced by node count · self-hosted sandlock.io · 4 Oct 2026

Compared on sandbox software

Free plan: Yes
Persistent storage: Yes
Network controls: Yes
API or CLI access: Yes
Deployment: self_hosted

Best Sandlock alternatives

See all 20

Two bars ANY.RUN Free tier No. 1Free6.7 Two bars Daytona Free tier No. 2Free6.6 Two bars Docker Desktop Free tier No. 3$9/mo6.6 Two bars Northflank Free tier No. 4Free6.6 Two bars Anthropic Sandbox Runtime Free tier No. 5Free6.5 Two bars microsandbox Free tier No. 6$49/mo6.5

The record

Purpose: Sandlock is a lightweight Linux process sandbox for confining untrusted code with kernel-enforced policies.
Enforcement: It uses Landlock, seccomp-bpf, and seccomp user notification to control filesystem, network, syscalls, and resources.
Policy controls: Policies can restrict filesystem access, default-deny network egress, apply HTTP method/host/path rules, inject credentials, stage writes with copy-on-write, and set resource limits.
Interfaces: The product provides a CLI, Python SDK, Rust API, Go SDK, OCI runtime, and MCP server.
Integrations: The OCI runtime works with containerd, CRI-O, and Kubernetes, and the remote MCP API can be used with Claude Desktop, Cursor, or another MCP client.
Use cases: The maker describes use for AI agent tool use, CI and untrusted builds, and per-request code execution.
Privileges: Sandlock runs as an ordinary user and does not require root, a container runtime, or a hypervisor.
Kernel requirement: Linux 6.12 or later supports the full protection set by default; older kernels can be used if missing protections are explicitly waived per policy.
Threat boundary: Sandlock shares the host kernel, and its security guarantees do not cover kernel vulnerabilities or hardware side channels.
Credential handling: The supervisor attaches secrets in the proxy only after the HTTP ACL check, so the sandboxed workload does not hold the secret value.
Commercial deployment: The commercial HTTP API and Scheduler are licensed software deployed on the customer's infrastructure, with no hosted or shared-tenant offering.
Support: Engineering support and a response SLA are included with each commercial license.
Company: Sandlock is a Multikernel Technologies project; the maker lists its address as San Jose, California.
Headquarters: San Jose, California, United States
Price from: Free

Where it ranks on Freedom251

Best Sandbox Software in 2026#11 of 22

Is Sandlock yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Sandlock

Sources

sandlock.io· checked 4 Oct 2026
sandlock.io/enterprise.html· checked 4 Oct 2026
sandlock.io/docs/getting-started.html· checked 4 Oct 2026
sandlock.io/security.html· checked 4 Oct 2026