---
id: nono-py
version: "0.15.0"
license: Apache-2.0
license_treatment: permissive
maintenance: active
---

# nono-py — Python bindings for nono capability-based sandboxing

License: permissive · Maintenance: active · Downloads: 110.0K/mo

## What it is and what it does

nono-py wraps a Rust-based sandboxing library that enforces capability-based access control at the OS level. Once you apply a sandbox to a process, unauthorized operations become structurally impossible—the kernel itself blocks them, not a userspace filter. The package lets you build a capability set that grants specific filesystem paths (with read/write/execute modes), blocks network access, or runs child processes in isolated sandboxes while the parent remains unsandboxed.

Beyond basic sandboxing, nono-py includes a network proxy for domain-filtered HTTP access with credential injection (so sandboxed code never sees real API keys), filesystem snapshots with rollback, append-only audit logging with tamper detection, and resource limiting (memory and process count) on Linux with cgroup v2. It depends on cryptography and pydantic for its runtime, and is currently in alpha development status.

Use it for:

- Run untrusted or third-party Python code (agents, plugins) with restricted filesystem and network access.
- Enforce least-privilege access for microservices or batch jobs that only need specific directories or APIs.
- Audit and replay sandboxed executions using the built-in Merkle-chained audit trail and filesystem snapshots.
- Inject API credentials into sandboxed child processes without exposing secrets to the sandboxed code.
- Limit resource consumption (memory, process count) for long-running or potentially runaway workloads.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

nono-py provides Python bindings for OS-enforced sandboxing using Landlock (Linux) and Seatbelt (macOS), letting you restrict a process's filesystem and network access before execution.

Yes, if you need OS-enforced sandboxing for untrusted code on Linux or macOS. The package is actively maintained, has no known vulnerabilities, and offers a comprehensive API for capability-based isolation plus audit and rollback features. Install friction is moderate (prebuilt wheels available, but source builds need Rust). The alpha status and small community (34 stars) mean the API may change and edge cases may not be fully explored—suitable for projects where security isolation is a core requirement, less so for casual use.

## Install

pip install nono-py
uv add nono-py
poetry add nono-py

## Installing nono-py

Before you install: Medium install friction: the package ships prebuilt wheels for Python 3.10–3.14 on macOS and Linux, but building from source requires the Rust toolchain and maturin. Active maintenance with a release 7 days ago and 34 repository stars.

License in practice: Apache-2.0 permissive license; you may use, modify, and distribute this package freely in commercial or private projects, provided you include a copy of the license and state any material changes.

Quickstart:

pip install nono-py

from nono_py import CapabilitySet, AccessMode, apply, is_supported

if is_supported():
    caps = CapabilitySet()
    caps.allow_path("/tmp", AccessMode.READ_WRITE)
    caps.block_network()
    apply(caps)  # Sandbox is now active and irreversible

Requires Python >=3.10; sandboxing is only supported on Linux (Landlock) and macOS (Seatbelt)—check is_supported() before applying.

Verify before relying:

- Whether prebuilt wheels are available for all advertised Python versions on all platforms, or if some combinations require source compilation.
- Performance overhead of sandboxing operations relative to unsandboxed execution.
- Compatibility with containerized or virtualized environments (Docker, Kubernetes, cloud VMs).

## Package facts

- License: Apache-2.0 (permissive)
- Python support: supports_current
- Install friction: medium
- Maintenance: active
- Downloads: 110.0K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

process sandboxing python, capability-based security, landlock seatbelt bindings, restrict file network access, os-enforced sandbox, python security isolation, filesystem access control, sandboxing, capability-based-security, process-isolation

[View on SkillFed](https://skillfed.io/packages/nono-py) · [View on PyPI](https://pypi.org/project/nono-py/)