1 of 9

Building rootless Linux Sandboxes from first principles

Raunak Ramakrishnan

2 of 9

Why Rootless Sandboxing Matters

  • Developer machines, CI with complex build-time deps, AI agents
  • Shared hosts + untrusted code = security challenge
  • Rootless sandboxes reduce blast radius without root

3 of 9

User Namespaces - Least Privilege Identity

  • User namespaces let an unprivileged user map host UIDs/GIDs into a private namespace and appear as “root” inside it
  • Processes inside a user namespace can perform privileged operations within that namespace but are still non-root on the host
  • This enables rootless containers/sandboxes to do things like create filesystem layouts or configure other namespaces without host root.

4 of 9

Seccomp: System Call Filtering

  • Linux seccomp lets a process specify a filtering policy for system calls
  • Seccomp filters limit what system calls a process can make into the kernel
  • Filtering reduces kernel attack surface and enforces policy boundaries
  • Seccomp filters are typically written in a BPF-like language and installed into the kernel; once installed, they are enforced for the life of the process

5 of 9

Landlock: User-Space Policy Enforcement

  • Landlock is a Linux Security Module (LSM) designed for unprivileged sandboxing
  • Allows a process to restrict its own filesystem access
  • Policies are enforced by the kernel and cannot be relaxed later

6 of 9

Filesystem Views: Reducing What a Process Can See

  • Rootless sandboxes rely on mount namespaces + bind/overlay mounts
  • Bind mounts expose only required paths
  • Overlayfs enables writable views over read-only bases

7 of 9

Userspace Networking - Why is it not straightforward

  • Linux provides no simple unprivileged primitive for networking
  • A new network namespace starts with no network access
  • Creating interfaces, routing, and NAT usually requires CAP_NET_ADMIN
    • Standard container networking uses veth pair + bridge
  • Rootless sandboxes must rely on userspace TCP/IP stacks like gvisor-netstack or slirp4netns

8 of 9

Demo

  • Let’s try building a sandbox from scratch
  • Code

9 of 9

References