ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity
Rootless gVisor sandbox for development tools and coding agents.
190 commits 1 branch 3 tags 8.4 MiB
  • Rust 93.5%
  • Python 6%
  • Shell 0.4%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
ms2k 30fc02d79f Containerize local builds with rootless nerdctl
2026-08-18 01:36:48 +09:00
.cargo Implement fail-closed ignored workspace routing 2026-07-16 13:04:12 +09:00
crates Render host escalation cards with Ratatui 2026-08-04 00:42:39 +09:00
docs Move the product specification under docs/spec 2026-08-18 01:36:13 +09:00
LICENSES License Lazaret under Apache 2.0 2026-08-18 01:35:35 +09:00
patches Recognize terminated runsc gofers during teardown 2026-08-02 19:57:36 +09:00
tests Containerize local builds with rootless nerdctl 2026-08-18 01:36:48 +09:00
tools Containerize local builds with rootless nerdctl 2026-08-18 01:36:48 +09:00
.clippy.toml Confine verification tooling to current repository checks 2026-07-14 02:19:07 +09:00
.gitignore Bootstrap verified Rust implementation workspace 2026-07-13 02:25:59 +09:00
Cargo.lock Render host escalation cards with Ratatui 2026-08-04 00:42:39 +09:00
Cargo.toml Render host escalation cards with Ratatui 2026-08-04 00:42:39 +09:00
deny.toml Close hostile recovery and concurrency gaps 2026-07-18 05:47:15 +09:00
LICENSE License Lazaret under Apache 2.0 2026-08-18 01:35:35 +09:00
README.md Containerize local builds with rootless nerdctl 2026-08-18 01:36:48 +09:00
rust-toolchain.toml Bind sandbox handoff authority and restore verifier gates 2026-07-17 23:23:19 +09:00
THIRD_PARTY_NOTICES.md License Lazaret under Apache 2.0 2026-08-18 01:35:35 +09:00

README.md

Lazaret

Rootless gVisor sandbox for development tools and coding agents.

Status

  • Early development
  • Source only; no binary releases
  • Linux x86-64, kernel 6.9 or newer

Host requirements

  • Unprivileged user namespaces
  • Contiguous subordinate UID and GID ranges of at least 65,536 IDs
  • /usr/bin/newuidmap, /usr/bin/newgidmap, and /usr/bin/slirp4netns
  • /dev/fuse, fuse-overlayfs, and fusermount3
  • Rootless nerdctl with BuildKit
  • cmp, install, and sha256sum

Build and install

tools/install-to-host

The default destination is ~/.local/bin. Pass --install-dir DIRECTORY to override it.

Configure and run

mkdir -p ~/.config/lazaret
cp docs/example.toml ~/.config/lazaret/config.toml
lazaret default
lazaret default -- COMMAND ARGUMENT...

Edit the example network allowlists and persistent volume paths before use.

Repository