lazaret/README.md

Lazaret

Rootless gVisor sandbox for development tools and coding agents.

Status

• Early development
• Linux x86-64, kernel 6.9 or newer

Host requirements

• Unprivileged user namespaces
• Contiguous subordinate UID and GID ranges of at least 65,536 IDs
• /usr/bin/newuidmap, /usr/bin/newgidmap, and /usr/bin/slirp4netns
• /dev/fuse, fuse-overlayfs, and fusermount3
• Rootless nerdctl with BuildKit
• cmp, install, and sha256sum

Build and install

tools/install-to-host

The default destination is ~/.local/bin. Pass --install-dir DIRECTORY to override it.

Configure and run

mkdir -p ~/.config/lazaret
cp docs/example.toml ~/.config/lazaret/config.toml
lazaret default
lazaret default -- COMMAND ARGUMENT...

Edit the example network allowlists and persistent volume paths before use.

Repository

• Product specification
• Example configuration
• Verification entry point
• Apache License 2.0
• Notices