Provides easy-to-use Linux seccomp-bpf jailing.

Composable agent runtime with enforced isolation boundaries

DSL language to write seccomp filters

A portable version of OpenBSD's privsep/sandboxed file(1) utility

Generate VM's with kernel tracing, code sandboxing and security profiles for long running agents.

A lightweight process isolation tool, requiring absolutely no privileges to run

force-bind with seccomp-bpf notifications

A survey and analysis of source code sandboxing

trace and intercept linux syscalls.

Lightweight process-based sandbox for Linux, no container, no VM, no root.

Seccomp-based proxy leak detector and proxifier.

Go library to reduce privileges on Linux by syscall groups through seccomp-bpf.

Lightweight, secure, single-file HTTP/HTTPS proxy in C with zero dependencies

Automated Approach for Generation of Seccomp System Call Filters

A Golang-based syscall interception tool using Seccomp Notify as an alternative to ptrace

BSc thesis on Linux kernel sandboxing with Landlock & seccomp

Simple demonstration of tracing processes in Go using ptrace and seccomp

x86_64 Linux sandboxing runtime utilizing namespaces, seccomp-bpf, and cgroups