nono
Sandboxing tool that restricts the filesystem, network and command access of AI coding agents.
Used to sandbox AI coding agents so they can safely run in YOLO or permission-skipping mode,1234 with policy-based blocking, proxy credential injection and rollbacks.567 The most common caveat is that writing per-project policies can be cumbersome,89 and one daily user notes it is not a perfect sandbox.10
Why people recommend it
Safe YOLO mode · 3
Gives commenters enough confidence to run agents without one-by-one approval prompts.
“Nono has been my daily driver since the start of the year.”
Show 1 more
“The external sandboxing tool I use (nono) supports rollbacks for this kind of situation.”
Action blocking · 2
Blocks agent actions that can't be prompted around, enforced outside the agent harness.
“We use nono [1] for this internally, essentially blocking any actions we don't want agents to be able to do without human approval.”
“The flexibility of a good nono setup (which is easy because they ship a nono skill that claude can consume) actually locks things down significantly better”
Easy policies · 2
Tries to make policy writing easy and ships a nono skill that Claude can consume.
“Nono does try to make policy writing easy”
“The flexibility of a good nono setup (which is easy because they ship a nono skill that claude can consume) actually locks things down significantly better”
Credential injection · 1
Its proxy injects real API credentials so the agent only sees dummy ones.
“For my LLM agents, I use a tool called Nono, whose macOS implementation is built on the same foundation as sandbox-exec.”
Rollbacks · 1
Supports rolling back destructive changes an agent makes.
“The external sandboxing tool I use (nono) supports rollbacks for this kind of situation.”
No microVM · 1
Avoids a microVM, so already-installed tooling works inside the sandbox.
“Nono does try to make policy writing easy”
Caveats and dissent
Policy upkeep · 3
Every project seems to need new access rules, and one user found limiting commands cumbersome.
“Nono does try to make policy writing easy”
“I tried nono to limit commands an agent can run but that proved to be cumbersome.”
Show 1 more
“I use Pi inside nono.sh sandbox”
Imperfect isolation · 1
Default network rules allow escape via a global tmux server.
“Nono has been my daily driver since the start of the year.”
Who recommends it in their own words
From the makers not counted in the ranking
“I wanted to introduce a project I have building for the past few weeks”
Threads where it came up
- Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor 1 mention
- Ask HN: How do you gate an autonomous coding agent's shell access? 1 mention
- Docker Sandboxes – Disposable, isolated sandboxes for AI agents 1 mention
- OpenChamber: An Agentic Development Environment 1 mention
- Claude Code: Starting August 14, auto mode will be the default permission mode 1 mention
- Git worktrees are not an isolation boundary for coding agents 1 mention
Also written as Nono, nono.sh. Data: nono.json. Quotes are verbatim; the verdict and theme labels are written by a model from these comments, and every clause links to its sources.
All comments 12
“For my LLM agents, I use a tool called Nono, whose macOS implementation is built on the same foundation as sandbox-exec.”
“I tried nono to limit commands an agent can run but that proved to be cumbersome.”
“Nono has been my daily driver since the start of the year.”
“The flexibility of a good nono setup (which is easy because they ship a nono skill that claude can consume) actually locks things down significantly better”
“I'll be sandboxing agents (with tools like nono, smolmachines, etc) going forward”
“We use nono [1] for this internally, essentially blocking any actions we don't want agents to be able to do without human approval.”
“I use nono.sh for sandboxing”
“inside nono (sandbox)”
“I use Pi inside nono.sh sandbox”
“but also have seen nono: https://github.com/always-further/nono”
“Nono does try to make policy writing easy”
“The external sandboxing tool I use (nono) supports rollbacks for this kind of situation.”