Skip to main content
The nono SDK exports several module-level functions for applying sandboxes and querying platform support.

​
apply

function apply(caps: CapabilitySet): void
Apply the sandbox with the given capabilities. This function activates OS-level sandboxing using Landlock (Linux) or Seatbelt (macOS).
​
caps
CapabilitySet
required
The capability set defining what the process can access.
This operation is irreversible. Once applied, the sandbox cannot be weakened, modified, or removed for the lifetime of the process. All child processes inherit the same restrictions.

​
Behavior

  • Validates all paths in the capability set exist
  • Activates the appropriate OS sandbox mechanism
  • Throws an error if sandboxing fails

​
Errors

ErrorCause
Path validationA path in the capability set doesn’t exist
Platform errorSandbox mechanism unavailable or failed to activate
Permission deniedInsufficient privileges to apply sandbox

​
Example

import { CapabilitySet, AccessMode, apply, isSupported } from 'nono-ts';

if (!isSupported()) {
  console.error('Sandboxing not available');
  process.exit(1);
}

const caps = new CapabilitySet();
caps.allowPath('/tmp', AccessMode.ReadWrite);
caps.allowPath('/usr/lib', AccessMode.Read);
caps.blockNetwork();

try {
  apply(caps);
  console.log('Sandbox applied successfully');
} catch (error) {
  console.error('Failed to apply sandbox:', error.message);
  process.exit(1);
}

// Process is now sandboxed

​
isSupported

function isSupported(): boolean
Check if sandboxing is supported on the current platform.
​
return
boolean
true if sandboxing is available, false otherwise.

​
Platform Support

PlatformSupportedRequirements
LinuxYesKernel 5.13+ with Landlock
macOSYesmacOS 10.5+
WindowsNo—

​
Example

import { isSupported } from 'nono-ts';

if (isSupported()) {
  console.log('Sandboxing is available');
} else {
  console.log('Sandboxing is not available on this platform');
}

​
supportInfo

function supportInfo(): SupportInfoResult
Get detailed information about sandbox support on the current platform.
​
return
SupportInfoResult
Object containing platform support details.

​
SupportInfoResult

​
isSupported
boolean
required
Whether sandboxing is supported.
​
platform
string
required
Platform identifier: "linux", "macos", or "unsupported".
​
details
string
required
Human-readable description of the sandbox backend and any limitations.

​
Example

import { supportInfo } from 'nono-ts';

const info = supportInfo();

console.log(`Supported: ${info.isSupported}`);
console.log(`Platform: ${info.platform}`);
console.log(`Details: ${info.details}`);

// Example output on macOS:
// Supported: true
// Platform: macos
// Details: macOS Seatbelt sandbox available

// Example output on Linux:
// Supported: true
// Platform: linux
// Details: Landlock ABI v4 available

​
Use Cases

import { supportInfo, apply } from 'nono-ts';

function initSandbox(caps: CapabilitySet) {
  const info = supportInfo();

  if (!info.isSupported) {
    // Decide how to handle unsupported platforms
    if (process.env.REQUIRE_SANDBOX === 'true') {
      throw new Error(`Sandbox required but not available: ${info.details}`);
    }
    console.warn(`Warning: Running without sandbox (${info.details})`);
    return;
  }

  console.log(`Applying ${info.platform} sandbox: ${info.details}`);
  apply(caps);
}

​
Usage Pattern

A typical application setup: 
import {
  CapabilitySet,
  AccessMode,
  apply,
  isSupported,
  supportInfo,
} from 'nono-ts';

function setupApplication() {
  // 1. Check support
  const info = supportInfo();
  if (!info.isSupported) {
    console.warn(`Sandbox unavailable: ${info.details}`);
    return;
  }

  // 2. Build capabilities
  const caps = new CapabilitySet();

  // Application data
  caps.allowPath('/var/app/data', AccessMode.ReadWrite);

  // Configuration (read-only)
  caps.allowFile('/etc/app/config.json', AccessMode.Read);

  // Runtime libraries
  caps.allowPath('/usr/lib', AccessMode.Read);
  caps.allowPath('/lib', AccessMode.Read);

  // Temp directory
  caps.allowPath('/tmp', AccessMode.ReadWrite);

  // Block network if not needed
  if (!process.env.NEEDS_NETWORK) {
    caps.blockNetwork();
  }

  // 3. Apply sandbox
  try {
    apply(caps);
    console.log(`Sandbox active (${info.platform})`);
  } catch (error) {
    console.error('Sandbox failed:', error.message);
    process.exit(1);
  }
}

setupApplication();