# Lazaret

Rootless gVisor sandbox for development tools and coding agents.

## Status

- Early development
- Linux x86-64, kernel 6.9 or newer

## Host requirements

- Unprivileged user namespaces
- Contiguous subordinate UID and GID ranges of at least 65,536 IDs
- `/usr/bin/newuidmap`, `/usr/bin/newgidmap`, and `/usr/bin/slirp4netns`
- `/dev/fuse`, `fuse-overlayfs`, and `fusermount3`
- Rootless nerdctl with BuildKit
- `cmp`, `install`, and `sha256sum`

## Build and install

```sh
tools/install-to-host
```

The default destination is `~/.local/bin`. Pass `--install-dir DIRECTORY` to override it.

## Configure and run

```sh
mkdir -p ~/.config/lazaret
cp docs/example.toml ~/.config/lazaret/config.toml
lazaret default
lazaret default -- COMMAND ARGUMENT...
```

Edit the example network allowlists and persistent volume paths before use.

## Repository

- [Product specification](docs/spec/lazaret.md)
- [Example configuration](docs/example.toml)
- [Verification entry point](tools/verify)
- [Apache License 2.0](LICENSE)
- [Notices](NOTICE)