Skip to main content
nono is written in Rust. You’ll need the Rust toolchain installed.

​
Prerequisites

  • Rust 1.70 or later
  • Linux kernel 5.13+ (for Landlock support)
  • Kernel 6.7+ recommended (for network filtering)
Check your kernel version:
uname -r

​
Homebrew (macOS)

brew tap lukehinds/nono 
brew install nono

​
Prebuilt Binaries

Download the latest release from the Releases page.

​
Build from Source

# Clone the repository
git clone https://github.com/lukehinds/nono.git
cd nono

# Build release binary
cargo build --release

# Binary is at ./target/release/nono

​
Install to PATH

# Option 1: Copy to /usr/local/bin
sudo cp target/release/nono /usr/local/bin/

# Option 2: Add to your shell config
echo 'export PATH="$PATH:/path/to/nono/target/release"' >> ~/.zshrc

​
Cargo Install

cargo install nono
The crate is not yet published to crates.io. Use the source installation method for now.

​
Homebrew (macOS)

brew install nono
The Homebrew formula is not yet available. Use the source installation method for now.

​
Verify Installation

# Check version
nono --version

# Test with dry run
nono run --allow . --dry-run -- echo "Hello from sandbox"

​
Kernel Requirements (Linux)

nono uses Landlock, which requires kernel support:
Kernel VersionLandlock ABICapabilities
5.13+ABI v1Basic filesystem access control
5.19+ABI v2File rename across directories
6.2+ABI v3File truncation
6.7+ABI v4TCP network filtering
6.10+ABI v5Advanced socket/signal scoping
nono automatically detects the available ABI and uses the highest supported version. On older kernels, some features may be unavailable but filesystem sandboxing will still work.

​
Check Landlock Support

# Check if Landlock is available
cat /sys/kernel/security/lsm
# Should include "landlock" in the output
If Landlock is not listed, you may need to enable it in your kernel configuration or boot parameters.