ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity
Rootless gVisor sandbox for development tools and coding agents.
191 commits 1 branch 3 tags 8.4 MiB
  • Rust 93.5%
  • Python 6%
  • Shell 0.4%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
ms2k 465c40822a Package Apache license and standardize notices 
Adopt the conventional NOTICE layout and include required license material in published crate archives. Verify workspace license metadata and the host coordinator's bundled ncurses notices.
2026-08-19 21:28:23 +09:00
.cargo Implement fail-closed ignored workspace routing 2026-07-16 13:04:12 +09:00
crates Package Apache license and standardize notices 2026-08-19 21:28:23 +09:00
docs Move the product specification under docs/spec 2026-08-18 01:36:13 +09:00
LICENSES License Lazaret under Apache 2.0 2026-08-18 01:35:35 +09:00
patches Recognize terminated runsc gofers during teardown 2026-08-02 19:57:36 +09:00
tests Containerize local builds with rootless nerdctl 2026-08-18 01:36:48 +09:00
tools Package Apache license and standardize notices 2026-08-19 21:28:23 +09:00
.clippy.toml Confine verification tooling to current repository checks 2026-07-14 02:19:07 +09:00
.gitignore Bootstrap verified Rust implementation workspace 2026-07-13 02:25:59 +09:00
Cargo.lock Render host escalation cards with Ratatui 2026-08-04 00:42:39 +09:00
Cargo.toml Package Apache license and standardize notices 2026-08-19 21:28:23 +09:00
deny.toml Close hostile recovery and concurrency gaps 2026-07-18 05:47:15 +09:00
LICENSE License Lazaret under Apache 2.0 2026-08-18 01:35:35 +09:00
NOTICE Package Apache license and standardize notices 2026-08-19 21:28:23 +09:00
README.md Package Apache license and standardize notices 2026-08-19 21:28:23 +09:00
rust-toolchain.toml Bind sandbox handoff authority and restore verifier gates 2026-07-17 23:23:19 +09:00

README.md

Lazaret

Rootless gVisor sandbox for development tools and coding agents.

Status

  • Early development
  • Source only; no binary releases
  • Linux x86-64, kernel 6.9 or newer

Host requirements

  • Unprivileged user namespaces
  • Contiguous subordinate UID and GID ranges of at least 65,536 IDs
  • /usr/bin/newuidmap, /usr/bin/newgidmap, and /usr/bin/slirp4netns
  • /dev/fuse, fuse-overlayfs, and fusermount3
  • Rootless nerdctl with BuildKit
  • cmp, install, and sha256sum

Build and install

tools/install-to-host

The default destination is ~/.local/bin. Pass --install-dir DIRECTORY to override it.

Configure and run

mkdir -p ~/.config/lazaret
cp docs/example.toml ~/.config/lazaret/config.toml
lazaret default
lazaret default -- COMMAND ARGUMENT...

Edit the example network allowlists and persistent volume paths before use.

Repository