landstrip

landstrip runs commands in an OS-level sandbox using Landlock on Linux, Seatbelt on macOS, and AppContainer or restricted users on Windows.

Install

npm install --save-dev @landstrip/landstrip-api
npx landstrip run -p policy.json -- cargo test

The npm package installs a Node.js wrapper and a native binary for the current platform.

Usage

landstrip run -p policy.json -- cargo test
landstrip policy validate -p policy.json
landstrip policy resolve -p policy.json
landstrip doctor

Run landstrip --help or see landstrip(1) for the full command reference.

Agent extensions

Integration	Package	Documentation
OpenCode	opencode-landstrip	OpenCode
Pi	pi-landstrip	Pi

Policy

{
  "filesystem": {
    "allowWrite": ["."],
    "denyWrite": ["**/.env", "**/*.pem"],
    "denyRead": ["~/.ssh"],
    "allowRead": ["~/.ssh/config"]
  },
  "network": {
    "allowNetwork": false,
    "allowLocalBinding": false
  }
}

Pass policies with -p, --policy <FILE>. Later policies merge over earlier ones. Platform behavior and limits are documented in the manual.

Development

make ci

Licensing

Package	License
landstrip	LGPL 2.1+
@landstrip/landstrip-api	Apache 2.0
opencode-landstrip	Apache 2.0
pi-landstrip	Apache 2.0