# Install landrun with Homebrew, Nix Lightweight, secure sandbox for running Linux processes using Landlock LSM. Version 0.1.15 via Homebrew; verified from local package data. ## Install ```sh sudo av install brew:landrun ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install landrun ``` Evidence: local Homebrew formula metadata ### Linux - Nix (92%): ```sh nix profile install nixpkgs#landrun ``` Evidence: nixpkgs package indexes: pkgs/by-name/la/landrun/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 ## Package facts - **Package key:** brew:landrun - **Package manager:** Homebrew - **Package manager page:** - **Version:** 0.1.15 - **Source summary:** Lightweight, secure sandbox for running Linux processes using Landlock LSM - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** MIT - **Source archive:** - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - landrun (cli) - landrun (alias) ## Build dependencies - go ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 0.1.15 - Local data: ok - Upstream repository: https://github.com/Zouuup/landrun - Upstream latest detected: v0.1.15 (current) - info: No package-manager update timestamp was available. ## Project history and usage Landrun is a small Linux command-line sandbox that wraps the kernel Landlock security module so ordinary users can run a process with explicit filesystem and TCP access rules. ### Project history The project appeared publicly in March 2025 with early 0.1.x releases. Its README frames it as a practical front end for Landlock: no root, no containers, no SELinux or AppArmor policy files, and a command-line flag model for read, write, execute, bind, and connect permissions. The early release stream quickly refined the access model. Version 0.1.3, released on 2025-03-22, added a deny-all behavior when no sandbox rules are provided. Version 0.1.4, released on 2025-03-23, replaced a global execution flag with path-specific execution permissions. Version 0.1.10, released on 2025-03-23, expanded Landlock permission coverage and tests, and version 0.1.14, released on 2025-04-03, added helper flags for dynamically linked executables. ### Adoption history Landrun's adoption signal is mainly package-nerd and security-tool visibility rather than a long institutional history. The upstream README lists distro packaging for Arch AUR and SlackBuilds, and the Homebrew formula places it in the macOS/Linux package-manager ecosystem even though the underlying sandbox requires Linux Landlock support. ### How it is used Typical usage is to prefix another command with `landrun` and add only the paths and TCP ports that process should access. The README also documents a systemd integration pattern for wrapping services such as nginx with reduced filesystem and network permissions. ### Why package nerds care For package collectors, Landrun is notable because it turns a relatively obscure kernel LSM into a normal CLI tool. It sits near tools such as firejail and bubblewrap, but its hook is using unprivileged, kernel-native Landlock rules with a small Go implementation. ### Timeline - 2025-03-22: v0.1.3 release documented deny-all behavior when no sandbox rules are supplied. - 2025-03-23: v0.1.4 release introduced path-specific execution permissions. - 2025-03-23: v0.1.10 release expanded Landlock permission coverage and test coverage. - 2025-04-03: v0.1.14 release added `--ldd` and `--add-exec` helper flags. ### Related projects - Related projects include the Linux Landlock LSM, the go-landlock bindings used by Landrun, and user-facing Linux sandbox tools such as firejail and bubblewrap. ### Sources - - ## Security Notes narrow executable package without higher-risk signals. - **Geiger risk:** green / low - narrow executable package without higher-risk signals ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** landrun - **Version Scheme:** 0 - **Revision:** 0 - **Requirements:** linux - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** stable ## Other Package-Manager Records - Nix - landrun: normalized package name match | nixpkgs package indexes: pkgs/by-name/la/landrun/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 ## Related links - [Source-control packages](https://www.automicvault.com/pkg/source-control-tools/) - Belongs to a source-control command family. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Security and crypto packages](https://www.automicvault.com/pkg/security-crypto-tools/) - Matched security, identity, cryptography, password, signing, or certificate metadata. - [go](https://www.automicvault.com/pkg/brew/go/) - Build dependency declared by Homebrew. - [bubblewrap](https://www.automicvault.com/pkg/brew/bubblewrap/) - Shares av.db curated category or tags: cli, linux, sandbox, sandboxing, security. - [fence](https://www.automicvault.com/pkg/brew/fence/) - Shares av.db curated category or tags: cli, sandbox, sandboxing, security. - [libseccomp](https://www.automicvault.com/pkg/brew/libseccomp/) - Shares av.db curated category or tags: cli, linux, sandboxing, security. - [nono](https://www.automicvault.com/pkg/brew/nono/) - Shares av.db curated category or tags: cli, sandbox, sandboxing, security. - [sandvault](https://www.automicvault.com/pkg/brew/sandvault/) - Shares av.db curated category or tags: cli, sandbox, sandboxing, security. - [jailkit](https://www.automicvault.com/pkg/brew/jailkit/) - Shares av.db curated category or tags: cli, sandboxing, security. - [libcap](https://www.automicvault.com/pkg/brew/libcap/) - Shares av.db curated category or tags: cli, linux, security. - [libcap-ng](https://www.automicvault.com/pkg/brew/libcap-ng/) - Shares av.db curated category or tags: cli, linux, security. ## Combined YAML source View the package source record on GitHub. [combined/landrun.yml](https://github.com/automic-vault/db/blob/main/combined/landrun.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph