netblue30 / firejail

Linux namespaces and seccomp-bpf sandbox

sandstorm-io / sandstorm

Sandstorm is a self-hostable web productivity suite. It's implemented as a security-hardened web app package manager.

google / nsjail

A lightweight process isolation tool that utilizes Linux namespaces, cgroups, rlimits and seccomp-bpf syscall filters, leveraging the Kafel BPF language for enhanced security.

david942j / seccomp-tools

Provide powerful tools for seccomp analysis

fencesandbox / fence

Lightweight, container-free sandbox for running commands with network and filesystem restrictions

seccomp / libseccomp

The main libseccomp repository

kubernetes-sigs / security-profiles-operator

The Kubernetes Security Profiles Operator

multikernel / sandlock

The lightest AI sandbox. A process-based sandbox for Linux, no container, no VM, no privilege, no prompt injection

bytedance / vArmor

vArmor is a cloud-native container hardening system that leverages AppArmor/BPF/Seccomp and NetworkProxy technologies to enforce access control from system calls to application protocols — protecting workloads including AI Agents.

longze777 / UID-

通过seccomp过滤达到隐藏通过检查到内核分配uid但是查询对应的却不存在这一检测点进行修复