{"slug": "landlock", "name": "Landlock", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 2, "commenters": 3, "warners": 0, "score": 2.066, "rising": 0.67, "first": "2025-11-30", "latest": "2026-09-13", "why": "I like it because it just works as an unprivileged usermode program without setting anything up.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 2, "neutral": 1, "compare": 0, "warn": 0}, "spark": [1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0], "listed": false, "loved": [], "caveat": "", "short_quote": "I like it because it just works as an unprivileged usermode program without setting anything up.", "icon": false, "domain": "kernel.org", "github_repo": null, "official_url": "https://kernel.org", "pricing": "", "aliases": ["Landlock"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 794942225, "item_id": 49683889, "url": "https://news.ycombinator.com/item?id=49683889", "by": "mikemcquaid", "date": "2026-09-13", "stance": "recommend", "quote": "moved to Landlock this release", "excerpt": "Yup! We\u2019ve been using it for a really long time at this point. Were using Bubblewrap on Linux and moved to Landlock this release. P.S. HUGE fan of your blog and writing Simon, keep up the great work. It\u2019s the #1 resource I recommend to anyone in the industry wanting to learn more about LLMs (and pelicans).", "context": "Homebrew maintainer", "use_case": "sandboxing Homebrew on Linux", "switched_from": "Bubblewrap", "story": "Homebrew 7.0.0"}, {"id": 737531792, "item_id": 46095737, "url": "https://news.ycombinator.com/item?id=46095737", "by": "adeon", "date": "2025-11-30", "stance": "recommend", "quote": "I like it because it just works as an unprivileged usermode program without setting anything up.", "excerpt": "I've used Landlock to detect and stop unwanted telemetry. I wrote some C that stopped networking except to accept connections on a single port, no outgoing connections and no accepting connections on any other port. `dmesg` shows the connections it blocks (I think this is maybe the audit feature). I used an example sandboxer.c as a base (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/samples/la", "context": "", "use_case": "blocking unwanted telemetry", "switched_from": "", "story": "Landlock-Ing Linux"}]}], "caveats": [], "who": [{"by": "mikemcquaid", "context": "Homebrew maintainer", "url": "https://news.ycombinator.com/item?id=49683889", "date": "2026-09-13"}], "tags": [], "use_cases": ["sandboxing homebrew on linux", "unprivileged sandboxing", "blocking unwanted telemetry"], "compared": [{"slug": "bubblewrap", "name": "bubblewrap", "co": 2, "switched_from": 1, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=49681545", "title": "Homebrew 7.0.0", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49374269", "title": "Malicious Rust Crate Arrayref Runs a Build-Time Payload", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46090969", "title": "Landlock-Ing Linux", "mentions": 1}], "sentiment_by_month": {"2025-11": {"recommend": 1}, "2025-12": {}, "2026-01": {}, "2026-02": {}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {}, "2026-07": {}, "2026-08": {"neutral": 1}, "2026-09": {"recommend": 1}, "2026-10": {}}, "quotes": [{"id": 794942225, "item_id": 49683889, "url": "https://news.ycombinator.com/item?id=49683889", "by": "mikemcquaid", "date": "2026-09-13", "stance": "recommend", "quote": "moved to Landlock this release", "excerpt": "Yup! We\u2019ve been using it for a really long time at this point. Were using Bubblewrap on Linux and moved to Landlock this release. P.S. HUGE fan of your blog and writing Simon, keep up the great work. It\u2019s the #1 resource I recommend to anyone in the industry wanting to learn more about LLMs (and pelicans).", "context": "Homebrew maintainer", "use_case": "sandboxing Homebrew on Linux", "switched_from": "Bubblewrap", "story": "Homebrew 7.0.0"}, {"id": 790022160, "item_id": 49376385, "url": "https://news.ycombinator.com/item?id=49376385", "by": "insanitybit", "date": "2026-08-20", "stance": "neutral", "quote": "Yes, I use it!", "excerpt": "> Browsers have been sandboxing their tabs since 2008. Yes, it's an amazing feat that has cost billions and led to major features like seccomp v2, ptrace sandboxing, etc. Do you know the history of browser sandboxing? It's pretty complex, a major technical feat. > Don't sit there and tell me that bwrap, sandboxing, whatever is some kind of recent innovation with uneven distro support. I can tell you that unprivileged", "context": "", "use_case": "unprivileged sandboxing", "switched_from": "", "story": "Malicious Rust Crate Arrayref Runs a Build-Time Payload"}, {"id": 737531792, "item_id": 46095737, "url": "https://news.ycombinator.com/item?id=46095737", "by": "adeon", "date": "2025-11-30", "stance": "recommend", "quote": "I like it because it just works as an unprivileged usermode program without setting anything up.", "excerpt": "I've used Landlock to detect and stop unwanted telemetry. I wrote some C that stopped networking except to accept connections on a single port, no outgoing connections and no accepting connections on any other port. `dmesg` shows the connections it blocks (I think this is maybe the audit feature). I used an example sandboxer.c as a base (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/samples/la", "context": "", "use_case": "blocking unwanted telemetry", "switched_from": "", "story": "Landlock-Ing Linux"}]}