{"categories":[{"label":"Security","url":"https://skillfed.io/packages/category/security/3"}],"enrichment":{"capability":"nono-py provides Python bindings for OS-enforced sandboxing using Landlock (Linux) and Seatbelt (macOS), letting you restrict a process's filesystem and network access before execution.","skillfed_tags":["sandboxing","capability-based-security","process-isolation"],"use_cases":["Run untrusted or third-party Python code (agents, plugins) with restricted filesystem and network access.","Enforce least-privilege access for microservices or batch jobs that only need specific directories or APIs.","Audit and replay sandboxed executions using the built-in Merkle-chained audit trail and filesystem snapshots.","Inject API credentials into sandboxed child processes without exposing secrets to the sandboxed code.","Limit resource consumption (memory, process count) for long-running or potentially runaway workloads."],"what_it_does":"nono-py wraps a Rust-based sandboxing library that enforces capability-based access control at the OS level. Once you apply a sandbox to a process, unauthorized operations become structurally impossible\u2014the kernel itself blocks them, not a userspace filter. The package lets you build a capability set that grants specific filesystem paths (with read/write/execute modes), blocks network access, or runs child processes in isolated sandboxes while the parent remains unsandboxed.\n\nBeyond basic sandboxing, nono-py includes a network proxy for domain-filtered HTTP access with credential injection (so sandboxed code never sees real API keys), filesystem snapshots with rollback, append-only audit logging with tamper detection, and resource limiting (memory and process count) on Linux with cgroup v2. It depends on cryptography and pydantic for its runtime, and is currently in alpha development status.","worth_installing":"Yes, if you need OS-enforced sandboxing for untrusted code on Linux or macOS. The package is actively maintained, has no known vulnerabilities, and offers a comprehensive API for capability-based isolation plus audit and rollback features. Install friction is moderate (prebuilt wheels available, but source builds need Rust). The alpha status and small community (34 stars) mean the API may change and edge cases may not be fully explored\u2014suitable for projects where security isolation is a core requirement, less so for casual use."},"id":"nono-py","links":{"html":"https://skillfed.io/packages/nono-py","md":"https://skillfed.io/packages/nono-py.md","pypi":"https://pypi.org/project/nono-py/"},"maintenance":{"status":"active"},"meta":{"latest_release":"2026-08-07","license_spdx":null,"license_treatment":"permissive","name":"nono-py","python_support":"supports_current","summary":"Python bindings for nono capability-based sandboxing"},"popularity":{"monthly_downloads":109991,"position":12488,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"0.15.0"}