nono-py

Python bindings for nono, a capability-based sandboxing library.

nono provides OS-enforced sandboxing using Landlock (Linux) and Seatbelt (macOS). Once a sandbox is applied, unauthorized operations are structurally impossible.

Installation

pip install nono-py

From source

Requires Rust toolchain and maturin:

pip install maturin
maturin develop

Usage

from nono_py import CapabilitySet, AccessMode, apply, is_supported

# Check platform support
if not is_supported():
    print("Sandboxing not supported on this platform")
    exit(1)

# Build capability set
caps = CapabilitySet()
caps.allow_path("/tmp", AccessMode.READ_WRITE)
caps.allow_path("/home/user/project", AccessMode.READ)
caps.allow_file("/etc/hosts", AccessMode.READ)
caps.block_network()

# Apply sandbox (irreversible!)
apply(caps)

# Now the process can only access granted paths
# Network access is blocked
# This applies to all child processes too

API Reference

Sandboxing

`CapabilitySet` + `apply()`

Sandbox the current process (irreversible):

caps = CapabilitySet()
caps.allow_path("/tmp", AccessMode.READ_WRITE)
caps.block_network()
apply(caps)  # Process is now sandboxed

`sandboxed_exec`

Run a command in a sandboxed child process. The parent stays unsandboxed and can call this repeatedly with different capabilities:

caps = CapabilitySet()
caps.allow_path("/workspace", AccessMode.READ_WRITE)
caps.block_network()
result = sandboxed_exec(
    caps,
    ["python", "agent.py"],
    cwd="/workspace",
    timeout_secs=30.0,
)
print(result.stdout, result.exit_code)

sandboxed_exec does not inherit the parent process environment by default. Pass only the variables the child needs through env=[("NAME", "value")]. Full parent environment inheritance requires inherit_env=True; dynamic-loader variables such as LD_* and DYLD_* are rejected.

On timeout, sandboxed_exec kills the sandboxed command's process group so ordinary forked descendants are terminated with the direct child.

sandboxed_exec(..., max_processes=N) sets RLIMIT_NPROC in the child before exec. This is only meaningful when sandboxed executions run as a dedicated Unix UID, because the kernel counts all processes already owned by that real UID, not only processes in the sandbox tree. On a normal shared user account, setting a small value such as 8 can make the sandboxed program's first fork() fail with EAGAIN because the user already owns more than eight processes; it does not provide a reliable per-sandbox fork limit. Use cgroup pids.max or a dedicated container/microVM boundary for strong per-execution fork containment.

On Linux kernels before 6.7, proxy_only() uses a seccomp notification supervisor. The default listener handoff works under the unmodified Docker/containerd and AWS Fargate seccomp profile with all capabilities dropped; it does not require CAP_SYS_PTRACE, a privileged container, or a custom profile. NONO_PY_PROXY_HANDOFF=pidfd temporarily selects the one-release legacy rollback path. That legacy path may require a custom profile allowing only pidfd_getfd on ECS-EC2/EKS and is not suitable for Fargate.

For one compatibility release, sandboxed_exec(..., enforcement_mode="auto") retains the Landlock-first network behavior. Pass enforcement_mode="seccomp" to layer a static seccomp baseline under Landlock: plain block_network() denies non-Unix sockets, and policies with TCP port exceptions deny UDP, raw/non-IP sockets, and io_uring_setup(). The io_uring denial also affects programs using it only for file I/O. A future release will promote this baseline into Python's "auto" mode; "landlock" remains the explicit Landlock-only selection.

Unix-domain socket grants are trusted IPC channels. nono-py scrubs inherited descriptors before exec, but an allowed Unix peer can deliberately pass an already-connected Internet socket with SCM_RIGHTS; creation-time seccomp and Landlock connect/bind rules cannot retroactively restrict that descriptor.

Network Proxy

Domain-filtered network access for sandboxed children. The proxy intercepts outbound HTTP requests and enforces a host allowlist. For API calls, it performs credential injection: the sandboxed process sends a dummy token, and the proxy transparently swaps in the real API key (loaded from the OS keyring) before forwarding upstream. The sandboxed process never sees the real secret.

from nono_py import ProxyConfig, RouteConfig, start_proxy

config = ProxyConfig(
    allowed_hosts=["api.openai.com", "*.anthropic.com"],
    routes=[
        RouteConfig(prefix="/openai", upstream="https://api.openai.com", credential_key="openai-key"),
    ],
)
proxy = start_proxy(config)

# Inject only the current proxy/session env vars into the sandboxed child
env = proxy.sandbox_env(extra_env=[("NONO_SESSION_ID", "session-001")])
result = sandboxed_exec(caps, ["python", "agent.py"], env=env)

# Audit trail
events = proxy.drain_audit_events()
proxy.shutdown()

Filesystem Snapshots

Content-addressable snapshots with Merkle-committed state and rollback:

from nono_py import SnapshotManager, ExclusionConfig

mgr = SnapshotManager(
    session_dir="~/.nono/rollbacks/session-001",
    tracked_paths=["/workspace"],
    exclusion=ExclusionConfig(exclude_patterns=["node_modules", "__pycache__"]),
)
mgr.create_baseline()

# ... agent runs and modifies files ...

manifest, changes = mgr.create_incremental()
for change in changes:
    print(f"{change.change_type}: {change.path}")

# Roll back
mgr.restore_to(snapshot_number=0)

Audit Trail

Append-only, Merkle-chained audit logging with tamper detection:

from nono_py.audit import AlphaRecorder, verify_log, iter_session, session_started, session_ended

recorder = AlphaRecorder()
with open("audit-events.ndjson", "w") as f:
    recorder.write(f, session_started(started="2026-01-01T00:00:00Z", command=["agent"]))
    recorder.write(f, session_ended(ended="2026-01-01T00:05:00Z", exit_code=0))

# Verify integrity — detects any tampering
result = verify_log("/path/to/session")
assert result["records_verified"]

Resource Limiting

Run a command under a memory ceiling and/or a process-count cap by driving the tested nono CLI (Linux + cgroup v2):

memory= sets memory.max: a tree that exceeds it is OOM-killed (exit 137, surfaced as result.oom_killed).
max_processes= sets pids.max: at the cap the kernel refuses new fork/clone with EAGAIN. Nothing is killed — the offending process just fails to spawn — so there is no fixed exit code, only the command's own non-zero status.

from nono_py import AccessMode, CapabilitySet
from nono_py import limited

caps = CapabilitySet()
caps.allow_path("/work", AccessMode.READ_WRITE)

result = limited.run(caps, ["python", "hog.py"], memory="512M", max_processes=64)
if result.oom_killed:
    print("process exceeded its memory cap and was killed")
elif not result.ok:
    print(f"failed ({result.returncode}): {result.stderr}")

Enforcement lives in the nono binary (found on PATH, via NONO_BIN, or nono_bin=), not in-process — resource limits need an un-sandboxed supervisor parent, unlike apply(). Filesystem grants and block_network() are translated to CLI flags; proxy_only() is not carried across the subprocess boundary.

Other Classes

QueryContext - Check permissions without applying the sandbox
SandboxState - Serialize/restore capability sets as JSON
SupportInfo - Platform support details
Policy / ResolvedPolicy - Load and resolve policy.json documents
SessionMetadata - Session audit trail with Merkle roots and network events
ExecResult - Result of sandboxed_exec (stdout, stderr, exit_code)
InjectMode - Credential injection method enum

Functions

apply(caps) - Apply sandbox (irreversible)
sandboxed_exec(caps, command, ...) - Run command in sandboxed child
start_proxy(config) - Start network filtering proxy
is_supported() / support_info() - Platform support
load_policy(json) / load_embedded_policy() - Policy loading
embedded_policy_json() - Raw embedded policy JSON
validate_deny_overlaps(paths, caps) - Validate deny paths against capabilities

Platform Support

Platform	Backend	Requirements
Linux	Landlock	Kernel 5.13+ with Landlock enabled
macOS	Seatbelt	macOS 10.5+
Windows	-	Not supported

Development

# Install dev dependencies
pip install maturin pytest mypy

# Build and install for development
make dev

# Run tests
make test

# Run linters
make lint

# Format code
make fmt

License

Apache-2.0

Development Status
- 3 - Alpha
Intended Audience
- Developers
License
- OSI Approved :: Apache Software License
Operating System
- MacOS
- POSIX :: Linux
Programming Language
- Python :: 3
- Rust
Topic
- Security
Typing
- Typed

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

nono_py-0.16.0.tar.gz (290.0 kB view details)

Uploaded Aug 24, 2026 Source

Built Distributions

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

nono_py-0.16.0-cp314-cp314-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (10.5 MB view details)

Uploaded Aug 24, 2026 CPython 3.14manylinux: glibc 2.17+ x86-64

nono_py-0.16.0-cp314-cp314-manylinux_2_17_aarch64.manylinux2014_aarch64.whl (10.7 MB view details)

Uploaded Aug 24, 2026 CPython 3.14manylinux: glibc 2.17+ ARM64

nono_py-0.16.0-cp314-cp314-macosx_11_0_arm64.whl (8.1 MB view details)

Uploaded Aug 24, 2026 CPython 3.14macOS 11.0+ ARM64

nono_py-0.16.0-cp314-cp314-macosx_10_12_x86_64.whl (8.3 MB view details)

Uploaded Aug 24, 2026 CPython 3.14macOS 10.12+ x86-64

nono_py-0.16.0-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (10.5 MB view details)

Uploaded Aug 24, 2026 CPython 3.13manylinux: glibc 2.17+ x86-64

nono_py-0.16.0-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl (10.7 MB view details)

Uploaded Aug 24, 2026 CPython 3.13manylinux: glibc 2.17+ ARM64

nono_py-0.16.0-cp313-cp313-macosx_11_0_arm64.whl (8.1 MB view details)

Uploaded Aug 24, 2026 CPython 3.13macOS 11.0+ ARM64

nono_py-0.16.0-cp313-cp313-macosx_10_12_x86_64.whl (8.3 MB view details)

Uploaded Aug 24, 2026 CPython 3.13macOS 10.12+ x86-64

nono_py-0.16.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (10.5 MB view details)

Uploaded Aug 24, 2026 CPython 3.12manylinux: glibc 2.17+ x86-64

nono_py-0.16.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl (10.7 MB view details)

Uploaded Aug 24, 2026 CPython 3.12manylinux: glibc 2.17+ ARM64

nono_py-0.16.0-cp312-cp312-macosx_11_0_arm64.whl (8.1 MB view details)

Uploaded Aug 24, 2026 CPython 3.12macOS 11.0+ ARM64

nono_py-0.16.0-cp312-cp312-macosx_10_12_x86_64.whl (8.3 MB view details)

Uploaded Aug 24, 2026 CPython 3.12macOS 10.12+ x86-64

nono_py-0.16.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (10.5 MB view details)

Uploaded Aug 24, 2026 CPython 3.11manylinux: glibc 2.17+ x86-64

nono_py-0.16.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl (10.7 MB view details)

Uploaded Aug 24, 2026 CPython 3.11manylinux: glibc 2.17+ ARM64

nono_py-0.16.0-cp311-cp311-macosx_11_0_arm64.whl (8.1 MB view details)

Uploaded Aug 24, 2026 CPython 3.11macOS 11.0+ ARM64

nono_py-0.16.0-cp311-cp311-macosx_10_12_x86_64.whl (8.3 MB view details)

Uploaded Aug 24, 2026 CPython 3.11macOS 10.12+ x86-64

nono_py-0.16.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (10.5 MB view details)

Uploaded Aug 24, 2026 CPython 3.10manylinux: glibc 2.17+ x86-64

nono_py-0.16.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl (10.7 MB view details)

Uploaded Aug 24, 2026 CPython 3.10manylinux: glibc 2.17+ ARM64

nono_py-0.16.0-cp310-cp310-macosx_11_0_arm64.whl (8.1 MB view details)

Uploaded Aug 24, 2026 CPython 3.10macOS 11.0+ ARM64

nono_py-0.16.0-cp310-cp310-macosx_10_12_x86_64.whl (8.3 MB view details)

Uploaded Aug 24, 2026 CPython 3.10macOS 10.12+ x86-64

File details

Details for the file nono_py-0.16.0.tar.gz.

File metadata

Download URL: nono_py-0.16.0.tar.gz
Upload date: Aug 24, 2026
Size: 290.0 kB
Tags: Source
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for nono_py-0.16.0.tar.gz
Algorithm	Hash digest
SHA256	`61bc8063c7874bc20ff6e3a94daea605ec2efecb3b27ee564f11d8f380ff741a`
MD5	`66fc0caf3b9eff082a88a3146e414fbf`
BLAKE2b-256	`e6878c62d2f2b308ce905734b2840c4bab6a9a13f219c54f7817d39ccae32721`

Algorithm	Hash digest
SHA256	`65bcaa5327066e4963a505c443ce0cb843d556b962f3e85fee6875d9e4e270f4`
MD5	`9479d11f383e82d8318931a7a54423de`
BLAKE2b-256	`9d495cdb08cd72411423baabae84fcc3569bf96712c214d4421830a58e9b009e`

Algorithm	Hash digest
SHA256	`ff58f014203384ec27d86b842dfb58fe70930375763fb1777dee58be35e8f20c`
MD5	`c8520cfaf1a79af16ddbb899aab7b91b`
BLAKE2b-256	`66c307741aceeb39028d1ce1bb8686499c434c0b8fd98ba6cce6beff9bf9fbe7`

Algorithm	Hash digest
SHA256	`52f685565df8732a6406d2aabfec47618234f6759b5c2cae22f1559b5caf2c90`
MD5	`928eb230871b1d0af8184387abc3ea28`
BLAKE2b-256	`a24498343dbf39c9b3da59243934d2d036a0b703c855881d745a9b7893a808f2`

Algorithm	Hash digest
SHA256	`513fccef78998564ddc019338852600a4ae564386ee66b80d86ec44f0cd9355b`
MD5	`3f35d5e17b069168cc67857dd7d1d82e`
BLAKE2b-256	`1a0d7397b5dbbed9f061f4c4acc58b6bc3588ce70550c5a1dd889728b1ac70e8`

Algorithm	Hash digest
SHA256	`98327d434262ea8ab5374e77319c95e0f7809ff42108c148ef62527f01851928`
MD5	`74d3961a4ad59dd649f150f6a04affaf`
BLAKE2b-256	`01ff59ea82e466c683b207512a4ce9e6974a6a7518240577b0c0bd75a4a7989f`

Algorithm	Hash digest
SHA256	`b29757077d0578a0deaaf0e274b457a97a219c05f40e9fa631b737490fe06080`
MD5	`f526eee6649128d7d1ad72f21771954a`
BLAKE2b-256	`59ec5065ebf9f8f43f631cc406beedb74ab1f245bf3dea70bbdf71efebc2b4ec`

Algorithm	Hash digest
SHA256	`4ce3e0adeead13114d09d5c7043f19c697bd045169abaf5c0dbcec98d8a80d0f`
MD5	`669e6559b02fe06b9fd4a1d7079df345`
BLAKE2b-256	`b3ff5475680b52f738dc931e89d55933a480fb0f72d72db987e345d6b3d89b3f`

Algorithm	Hash digest
SHA256	`0a73a768fd97b7abf79784cb63adc54917d5b8e5db5d57843aace4a63f281df4`
MD5	`6c555fa790ae26ad1c93a864d4cb40b7`
BLAKE2b-256	`cd7796dd76078437284b756ee5e9ce3c8d8682abe22ef3e4e296d936d1e4c576`

Algorithm	Hash digest
SHA256	`4318699ee01f34cf47662f8cd0afb4fc023a81512ee961034cebb49b95fbf8af`
MD5	`62f16cf90b0289ee79869c21e651c182`
BLAKE2b-256	`16cf633fdd7293fb4dc30265aa8aefd8e85a9d9475a98a753b01e589898b7df0`

Algorithm	Hash digest
SHA256	`a106430fbfcd16416e4dea4abc5399aba095fc9516488fc6cf7ff841aea69983`
MD5	`ff10d3e9d500e53007573ea6f4a472bd`
BLAKE2b-256	`8cdac9e65d454828b949a9abf2eaa189af4ac8f3d053d01df15e7972bf1d069e`

Algorithm	Hash digest
SHA256	`70dcfad79ca7bc7354023b096b0b35daebfc4c36a8a17765cfddf3528ac0ba5a`
MD5	`98a884a99b74038ae7309e25f5836817`
BLAKE2b-256	`388d47e7e33796cb1fffc331760a6338abf18a381fa2613956c2d7931c77522a`

Algorithm	Hash digest
SHA256	`7543880b47f0b24d73b960d752623eff8634d20c7bf0e9a735cc3f88e09c25f0`
MD5	`6093da168c8a5f19bbf2b7576bd47b65`
BLAKE2b-256	`a8b2dd5682a169fb3f2b88d1da5613f9dd9c7f5396f147ef4ab1a34ada81fcbe`

Algorithm	Hash digest
SHA256	`97c7a072f780b2d4ab46f3bdc478b27f1f8b64fe211df047a8d2b0bbb2725527`
MD5	`7f1110a18b61fbff34279f0b9cff44ac`
BLAKE2b-256	`3eef9df45350da51b0cb7e376e257d3eb29cc60c9b5e1d3a7f030a5f2903a998`

Algorithm	Hash digest
SHA256	`3223dbfea39a7e5c5204b2762de97fd5b02e660885f6c6edaa4596b2e13fdb4d`
MD5	`9124d4e1231047eb4b8534c99c94e33a`
BLAKE2b-256	`5b58b6a39eead9e13a6c434f234bf0969e7adb11d2251a229c084330331dd8ea`

Algorithm	Hash digest
SHA256	`3f8e1d76ed5890513294596d0edd7140954e47559e66baaa1a3a0c6cb28334c4`
MD5	`3ae0c121ef2001a58294718baa0d35df`
BLAKE2b-256	`0e039e202cf39292a485ca09768541b903bc84c9290f2754f83a2ecee6cdf405`

Algorithm	Hash digest
SHA256	`9e6289ee19862b12064896ca80e2a7abde5fe69c16f5d12a4aa7bad95309f9f7`
MD5	`fdb6955d1f5f59b90c58cf67f4a58868`
BLAKE2b-256	`b8afc26a108e0024153a7a1fc68736cb38d7c466aa214b81cd65d347161ba9a1`

Algorithm	Hash digest
SHA256	`6b55c2663deaa52c6fff2ebcebf082c690ab222f9ccc6218b3a19422690e02d7`
MD5	`99916a4a84b20f93f644f244bd7cb1e0`
BLAKE2b-256	`0aa81ebdd8b2e2ebb70d2ef3923274e22768f03e237e594cc4c3d7adb1598db8`

Algorithm	Hash digest
SHA256	`2f60a7bf9b5fae5c6b9654816ca53b55f3183a63598f3d070474831e3f69d631`
MD5	`4d06f3cdaa04348360728870e38f804e`
BLAKE2b-256	`44eaff45c34fc1ae14c7f355cd76539092cef6cb4e1fa603e0fa194cd26514dc`

Algorithm	Hash digest
SHA256	`18859421ee4cae5e0aab44b104c1fd639ef95a2bdc12a83621318718b47ca917`
MD5	`db6a705ac448fd9c9bc9dc45730b8375`
BLAKE2b-256	`0f592f622a3e237738b8111f73b2aff3e93e1e9c871f70d1cc18ca6b45f2940f`

Algorithm	Hash digest
SHA256	`4d396324c6cdb9b82e80bf49e91e1b6ca24b5e2965df0d50e648f0fb3e3be146`
MD5	`47ab5c7328c39194775a25e0d26d9c48`
BLAKE2b-256	`381131914e2694779e71ebc498c0e66de2497a2b296346ea14f2889109e638ae`

nono-py 0.16.0

nono-py

Installation

From source

Usage

API Reference

Sandboxing

CapabilitySet + apply()

sandboxed_exec

Network Proxy

Filesystem Snapshots

Audit Trail

Resource Limiting

Other Classes

Functions

Platform Support

Development

License

Project links

Key dates

1 maintainer

Credits

GitHub Statistics

License

Requires

Provides Extra

Tags

Classifiers

Download files

Source Distribution

Built Distributions

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

File details

`CapabilitySet` + `apply()`

`sandboxed_exec`