Nono: Open-source kernel sandbox locks down AI agents with per-call credentials
3,100+ GitHub stars, kernel-level enforcement, and phantom keys that expire per tool call.
Nono, an open-source sandbox from nolabs (co-founded by Luke Hinds, creator of Sigstore), confines AI agents at the operating system kernel. It uses Landlock on Linux and Seatbelt on macOS to strip privileges from agent processes and enforce per-action policies—every file open, tool call, or network request is checked against code-defined rules at the kernel level. The sandbox is immutable for the life of the process. Nono has gained over 3,100 GitHub stars, 80+ contributors, and adoption by large enterprises including Datadog (staff security engineer James Carnegie is a user).
Its newest feature, Agent Tool Sandboxing, addresses broad session-long permissions by giving each tool call its own scoped authority with a phantom credential. The real secret stays in secure storage (OS keychain, 1Password, Bitwarden, or Kubernetes Secrets) and is only injected via a trusted proxy into the request to the approved external API. Authority expires when the call finishes. Nono currently supports Windows via WSL2; native Windows enforcement is under research. Available free on GitHub.
- Built by nolabs (co-founded by Sigstore creator Luke Hinds) and Stephen Parkinson; 3,100+ GitHub stars, 80+ contributors.
- Kernel-level enforcement via Landlock (Linux) and Seatbelt (macOS); Windows support via WSL2, native Windows under development.
- Agent Tool Sandboxing: per-call phantom credentials that expire, with real secrets retrieved from secure storage through a trusted proxy.
Why It Matters
Gives security teams fine-grained control over AI agents without slowing developer velocity—essential for production and regulated environments.