#1111th of 18 in Sandboxes
nono
Kernel-enforced sandbox and policy layer for running AI coding agents
- Stars
- 4.9k
- License
- Apache-2.0
- Last commit
- Nov 2026
- Last release
- Oct 2026
- Language
- Rust
2,053 on 22 Apr 20264,943 on 11 Nov 2026
From GitHub's daily star counts.
Checked on GitHub.
Overview
nono is a single unprivileged Rust binary that runs agents such as Claude Code, Codex, Goose or custom ones inside a kernel-enforced sandbox. Composable JSON profiles set filesystem, network, tool and credential rules, with proxy-based credential injection, Sigstore verification of skills and instruction files, tamper-evident audit logs and snapshot rollback. It runs on macOS, Linux and Windows via WSL2.
Who it is for: Engineers running coding agents who need enforced file and network limits
Strengths
- Single binary, no root needed; runs on laptops, CI, Kubernetes pods and microVMs
- Per-tool rules, e.g. aws may use a credential while curl cannot
- Credentials stay outside the sandbox via proxy injection and phantom tokens
- Registry of ready-made profiles for popular agents, extendable as composable JSON
Weaknesses
- README says APIs are still stabilizing ahead of a 1.0 release
- Windows support only through WSL2
- Policy model has a learning curve; detail lives in external docs
- No Docker image or compose file detected
What it needs
- no GPU
- Docker
What changed
- v0.81.0 ↗ (opens in a new tab)Security fix
GHSA-WH99-5QX8-CGH4, GHSA-P39G-3XW6-83JX, GHSA-P398-CGQF-C48X.
“feat(cli)!: remove legacy Claude hook cleanup by @SequeI in https://github.com/nolabs-ai/nono/pull/1973”
GHSA-Q7M6-RR8W-VJFF.
From the release notes. No flag means the note does not say so, not that the upgrade is safe.
Also in Sandboxes
See all 18| Rank | Project | Score |
|---|---|---|
| 1 | LightpandaHeadless browser written in Zig for agents and scraping, with CDP and MCP | 94 out of 100 |
| 2 | OpenShellPolicy-enforced sandbox runtime for autonomous AI agents | 89 out of 100 |
| 3 | ObscuraRust headless browser with V8 and CDP for scraping and agents | 87 out of 100 |
| #4 | opensandboxSandbox API for running AI agent code, commands and browsers in isolation | 87 out of 100 |
| #5 | NemoClawReference stack for running OpenClaw, Hermes and Deep Agents in OpenShell sandboxes | 86 out of 100 |